From 97571b16d8c73342e4bb78a37b9728839e7b8b78 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Mon, 9 Sep 2024 12:29:09 -0400
Subject: [PATCH 001/129] tests: removing intg/test_confdb.py

These test are covered test_sssctl.py

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
---
 src/tests/intg/Makefile.am    |   1 -
 src/tests/intg/test_confdb.py | 158 ----------------------------------
 2 files changed, 159 deletions(-)
 delete mode 100644 src/tests/intg/test_confdb.py

diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 0cfd268dce7..75c239a51a5 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -43,7 +43,6 @@ dist_noinst_DATA = \
     conftest.py \
     sssd_hosts.py \
     sssd_nets.py \
-    test_confdb.py \
     test_sss_cache.py \
     $(NULL)
 
diff --git a/src/tests/intg/test_confdb.py b/src/tests/intg/test_confdb.py
deleted file mode 100644
index 781c36961f9..00000000000
--- a/src/tests/intg/test_confdb.py
+++ /dev/null
@@ -1,158 +0,0 @@
-#
-# Confdb integration tests
-#
-# Copyright (c) 2022 Red Hat, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import os
-import stat
-import signal
-import subprocess
-import time
-import pytest
-
-import config
-from util import unindent
-
-
-def create_conf_file(contents):
-    """Create sssd.conf with specified contents"""
-    with open(config.CONF_PATH, "w") as conf:
-        conf.write(contents)
-    os.chmod(config.CONF_PATH, stat.S_IRUSR | stat.S_IWUSR)
-
-
-def cleanup_conf_file():
-    """Remove sssd.conf, if it exists"""
-    if os.path.lexists(config.CONF_PATH):
-        os.unlink(config.CONF_PATH)
-
-
-def create_conf_cleanup(request):
-    """Add teardown for removing sssd.conf"""
-    request.addfinalizer(cleanup_conf_file)
-
-
-def create_conf_fixture(request, contents):
-    """
-    Create sssd.conf with specified contents and add teardown for removing it
-    """
-    create_conf_file(contents)
-    create_conf_cleanup(request)
-
-
-def create_sssd_process():
-    """Start the SSSD process"""
-    if subprocess.call(["sssd", "-D", "--logger=files"]) != 0:
-        raise Exception("sssd start failed")
-
-
-def get_sssd_pid():
-    with open(config.PIDFILE_PATH, "r") as pid_file:
-        pid = int(pid_file.read())
-    return pid
-
-
-def cleanup_sssd_process():
-    """Stop the SSSD process and remove its state"""
-    try:
-        pid = get_sssd_pid()
-        os.kill(pid, signal.SIGTERM)
-        while True:
-            try:
-                os.kill(pid, signal.SIGCONT)
-            except OSError:
-                break
-            time.sleep(1)
-    except OSError:
-        # Ignore the error.
-        pass
-    for path in os.listdir(config.DB_PATH):
-        os.unlink(config.DB_PATH + "/" + path)
-    for path in os.listdir(config.MCACHE_PATH):
-        os.unlink(config.MCACHE_PATH + "/" + path)
-
-
-def test_domains__domains(request):
-    """
-    Test that SSSD starts with explicitly configured domain.
-    """
-    conf = unindent("""\
-        [sssd]
-        services = nss, sudo
-        domains = test
-
-        [domain/test]
-        id_provider = proxy
-        proxy_lib_name = files
-        auth_provider = none
-    """)
-
-    create_conf_fixture(request, conf)
-
-    try:
-        create_sssd_process()
-    except Exception:
-        assert False
-    finally:
-        cleanup_sssd_process()
-
-
-def test_domains__enabled(request):
-    """
-    Test that SSSD starts without domains option.
-    """
-    conf = unindent("""\
-        [sssd]
-        services = nss, sudo
-
-        [domain/test]
-        enabled = true
-        id_provider = proxy
-        proxy_lib_name = files
-        auth_provider = none
-    """)
-
-    create_conf_fixture(request, conf)
-
-    try:
-        create_sssd_process()
-    except Exception:
-        assert False
-    finally:
-        cleanup_sssd_process()
-
-
-def test_domains__empty(request):
-    """
-    Test that SSSD fails without any domain enabled.
-    """
-    conf = unindent("""\
-        [sssd]
-        services = nss, sudo
-        enable_files_domain = false
-
-        [domain/test]
-        id_provider = proxy
-        proxy_lib_name = files
-        auth_provider = none
-    """)
-
-    create_conf_fixture(request, conf)
-    with pytest.raises(Exception):
-        create_sssd_process()
-
-    cleanup_sssd_process()

From e442fdf717135f169ced3b7e1395157830480f53 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Mon, 9 Sep 2024 12:32:19 -0400
Subject: [PATCH 002/129] tests: removing intg/test_files_ops.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These tests the user/remove functions and can be dropped.

Reviewed-by: Anuj Borah <aborah@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tests/intg/Makefile.am       |  1 -
 src/tests/intg/test_files_ops.py | 85 --------------------------------
 2 files changed, 86 deletions(-)
 delete mode 100644 src/tests/intg/test_files_ops.py

diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 75c239a51a5..ee76c99eff1 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -23,7 +23,6 @@ dist_noinst_DATA = \
     test_netgroup.py \
     test_sssctl.py \
     files_ops.py \
-    test_files_ops.py \
     test_files_provider.py \
     kdc.py \
     krb5utils.py \
diff --git a/src/tests/intg/test_files_ops.py b/src/tests/intg/test_files_ops.py
deleted file mode 100644
index f778a89b063..00000000000
--- a/src/tests/intg/test_files_ops.py
+++ /dev/null
@@ -1,85 +0,0 @@
-#
-# SSSD integration test - operations on UNIX user and group database
-#
-# Copyright (c) 2016 Red Hat, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-import pwd
-import grp
-import pytest
-
-import ent
-
-
-USER1 = dict(name='user1', passwd='*', uid=10001, gid=20001,
-             gecos='User for tests',
-             dir='/home/user1',
-             shell='/bin/bash')
-
-GROUP1 = dict(name='group1',
-              gid=30001,
-              mem=['user1'])
-
-
-def test_useradd(passwd_ops_setup):
-    with pytest.raises(KeyError):
-        pwd.getpwnam("user1")
-    passwd_ops_setup.useradd(**USER1)
-    ent.assert_passwd_by_name("user1", USER1)
-
-
-def test_usermod(passwd_ops_setup):
-    passwd_ops_setup.useradd(**USER1)
-    ent.assert_passwd_by_name("user1", USER1)
-
-    USER1['shell'] = '/bin/zsh'
-    passwd_ops_setup.usermod(**USER1)
-    ent.assert_passwd_by_name("user1", USER1)
-
-
-def test_userdel(passwd_ops_setup):
-    passwd_ops_setup.useradd(**USER1)
-    ent.assert_passwd_by_name("user1", USER1)
-
-    passwd_ops_setup.userdel("user1")
-    with pytest.raises(KeyError):
-        pwd.getpwnam("user1")
-
-
-def test_groupadd(group_ops_setup):
-    with pytest.raises(KeyError):
-        grp.getgrnam("group1")
-    group_ops_setup.groupadd(**GROUP1)
-    ent.assert_group_by_name("group1", GROUP1)
-
-
-def test_groupmod(group_ops_setup):
-    group_ops_setup.groupadd(**GROUP1)
-    ent.assert_group_by_name("group1", GROUP1)
-
-    modgroup = dict(GROUP1)
-    modgroup['mem'] = []
-
-    group_ops_setup.groupmod(old_name=GROUP1["name"], **modgroup)
-    ent.assert_group_by_name("group1", modgroup)
-
-
-def test_groupdel(group_ops_setup):
-    group_ops_setup.groupadd(**GROUP1)
-    ent.assert_group_by_name("group1", GROUP1)
-
-    group_ops_setup.groupdel("group1")
-    with pytest.raises(KeyError):
-        grp.getgrnam("group1")

From f83ea91aa773050e992fd58753f670668f3549a8 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Sat, 14 Sep 2024 18:54:10 +0200
Subject: [PATCH 003/129] SYSTEMD: shell expansion of * doesn't work in
 ExecStartPre
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/sysv/systemd/sssd-kcm.service.in | 4 ++--
 src/sysv/systemd/sssd.service.in     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/sysv/systemd/sssd-kcm.service.in b/src/sysv/systemd/sssd-kcm.service.in
index 6c5c6aa43d0..0c839ec5cee 100644
--- a/src/sysv/systemd/sssd-kcm.service.in
+++ b/src/sysv/systemd/sssd-kcm.service.in
@@ -12,8 +12,8 @@ Environment=DEBUG_LOGGER=--logger=files
 ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@
 ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/sssd.conf
 ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/conf.d
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @secdbpath@/*.ldb
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_kcm.log
+ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @secdbpath@/*.ldb"
+ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_kcm.log
 ExecStart=@libexecdir@/sssd/sssd_kcm ${DEBUG_LOGGER}
 CapabilityBoundingSet= CAP_DAC_OVERRIDE CAP_CHOWN CAP_SETGID CAP_SETUID
 SecureBits=noroot noroot-locked
diff --git a/src/sysv/systemd/sssd.service.in b/src/sysv/systemd/sssd.service.in
index 32f35462bfe..5fd01a2ecef 100644
--- a/src/sysv/systemd/sssd.service.in
+++ b/src/sysv/systemd/sssd.service.in
@@ -14,8 +14,8 @@ ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@
 ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/sssd.conf
 ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/conf.d
 ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/pki
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @dbpath@/*.ldb
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @logpath@/*.log
+ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @dbpath@/*.ldb"
+ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/*.log"
 ExecStart=@sbindir@/sssd -i ${DEBUG_LOGGER}
 Type=notify
 NotifyAccess=main

From 43cfcfeedc558536e86dbc1e72a9c59f24a8a5bf Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 13 Sep 2024 19:51:58 +0200
Subject: [PATCH 004/129] SPEC: build C9S '--with-files-provider'

to match downstream

Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 contrib/sssd.spec.in | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 7f1c3a9ba72..7127b0babf5 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -599,6 +599,7 @@ autoreconf -ivf
 %if 0%{?rhel} == 9
     --with-libsifp \
     --with-conf-service-user-support \
+    --with-files-provider \
 %endif
 %if %{build_subid}
     --with-subid \
@@ -800,6 +801,9 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %{_libexecdir}/%{servicename}/sssd_check_socket_activated_responders
 
 %dir %{_libdir}/%{name}
+%if 0%{?rhel} == 9
+%{_libdir}/%{name}/libsss_files.so
+%endif
 %{_libdir}/%{name}/libsss_simple.so
 
 #Internal shared libraries
@@ -857,6 +861,9 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %{_mandir}/man1/sss_ssh_knownhostsproxy.1*
 %endif
 %{_mandir}/man5/sssd.conf.5*
+%if 0%{?rhel} == 9
+%{_mandir}/man5/sssd-files.5*
+%endif
 %{_mandir}/man5/sssd-simple.5*
 %{_mandir}/man5/sssd-sudo.5*
 %{_mandir}/man5/sssd-session-recording.5*

From ff1d8b76431150cdc9a171ad9ef059977d6bbbb8 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Sat, 14 Sep 2024 11:03:34 +0200
Subject: [PATCH 005/129] SPEC: build C9S '--with-extended-enumeration-support'

to match downstream

Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 contrib/sssd.spec.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 7127b0babf5..24936c2cd9c 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -600,6 +600,7 @@ autoreconf -ivf
     --with-libsifp \
     --with-conf-service-user-support \
     --with-files-provider \
+    --with-extended-enumeration-support \
 %endif
 %if %{build_subid}
     --with-subid \

From c62986827ac525ca7bf653b4d0e1e604384b35d9 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Sat, 14 Sep 2024 11:11:45 +0200
Subject: [PATCH 006/129] SPEC: build C9S '--with-ssh-known-hosts-proxy'

to match downstream

Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 contrib/sssd.spec.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 24936c2cd9c..90bb5bbdd0e 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -601,6 +601,7 @@ autoreconf -ivf
     --with-conf-service-user-support \
     --with-files-provider \
     --with-extended-enumeration-support \
+    --with-ssh-known-hosts-proxy \
 %endif
 %if %{build_subid}
     --with-subid \

From 41dfdccc84273aca3cbde9a8c8570c2fb3910545 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 10 Sep 2024 19:58:07 +0200
Subject: [PATCH 007/129] RESOLV: removed unused argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`resolv_gethostbyname_dns_parse()` didn't use `status` and it was
always set to `ARES_SUCCESS` anyway.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/resolv/async_resolv.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/resolv/async_resolv.c b/src/resolv/async_resolv.c
index 6b3a8ceeb75..1ccc4183a18 100644
--- a/src/resolv/async_resolv.c
+++ b/src/resolv/async_resolv.c
@@ -794,7 +794,7 @@ resolv_gethostbyname_dns_query_done(void *arg, int status, int timeouts,
                                     unsigned char *abuf, int alen);
 static int
 resolv_gethostbyname_dns_parse(struct gethostbyname_dns_state *state,
-                               int status, unsigned char *abuf, int alen);
+                               unsigned char *abuf, int alen);
 
 static struct tevent_req *
 resolv_gethostbyname_dns_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
@@ -935,7 +935,7 @@ resolv_gethostbyname_dns_query_done(void *arg, int status, int timeouts,
         return;
     }
 
-    ret = resolv_gethostbyname_dns_parse(state, status, abuf, alen);
+    ret = resolv_gethostbyname_dns_parse(state, abuf, alen);
     if (ret != EOK) {
         tevent_req_error(req, ret);
         return;
@@ -946,11 +946,12 @@ resolv_gethostbyname_dns_query_done(void *arg, int status, int timeouts,
 
 static int
 resolv_gethostbyname_dns_parse(struct gethostbyname_dns_state *state,
-                               int status, unsigned char *abuf, int alen)
+                               unsigned char *abuf, int alen)
 {
     struct hostent *hostent = NULL;
     int naddrttls;
     errno_t ret;
+    int status;
     void *addr = NULL;
 
     naddrttls = DNS_HEADER_ANCOUNT(abuf);

From 8227599e053850a4873f5632e9667488e6c42a55 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 9 Sep 2024 13:55:58 +0200
Subject: [PATCH 008/129] RESOLV: supress deprecation warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In theory new API might be somewhat better.

But:

1) it's fairly new: `ares_search_dnsrec()` and `ares_query_dnsrec()`
were introduced in c-ares-1.28 while even CentOS Stream 10 has
c-ares-1.25, so SSSD would need to support (fallback) old API anyway.

2) SSSD doesn't make heavy use of DNS, so potential performance
improvements are really negligible.

On the other hand, old API/ABI will be available for a long time:
https://github.com/c-ares/c-ares/pull/732#issuecomment-2028454381

For those reasons it's not worth the effort to port code to new API
right now.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/resolv/async_resolv.c | 1 -
 src/resolv/async_resolv.h | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/resolv/async_resolv.c b/src/resolv/async_resolv.c
index 1ccc4183a18..5459db5de11 100644
--- a/src/resolv/async_resolv.c
+++ b/src/resolv/async_resolv.c
@@ -27,7 +27,6 @@
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
 
-#include <ares.h>
 #include <talloc.h>
 #include <tevent.h>
 
diff --git a/src/resolv/async_resolv.h b/src/resolv/async_resolv.h
index a1f9285442d..0d3ad1acb12 100644
--- a/src/resolv/async_resolv.h
+++ b/src/resolv/async_resolv.h
@@ -27,6 +27,7 @@
 #define __ASYNC_RESOLV_H__
 
 #include <netdb.h>
+#define CARES_NO_DEPRECATED
 #include <ares.h>
 
 #include "config.h"

From 0e836edcffcfd5a859c541b0e0b12c1a846d7523 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Sat, 7 Sep 2024 12:51:08 +0200
Subject: [PATCH 009/129] cert util: replace deprecated OpenSSL calls

In OpenSSL 3.0 some of the calls we currently use in the utility
functions to covert the public key from a X.509 certificate into an ssh
public key got deprecated. This patch replaces them if OpenSSL 3.0 or
newer is used.

In contrast to the older calls which just returned references the new
calls return the requested data in freshly allocated memory. To keep
it consistent the data referenced by the old calls are copied into
allocated memory as well.

Resolves: https://github.com/SSSD/sssd/issues/5861

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 src/util/cert/libcrypto/cert.c | 199 ++++++++++++++++++++++++++++-----
 1 file changed, 171 insertions(+), 28 deletions(-)

diff --git a/src/util/cert/libcrypto/cert.c b/src/util/cert/libcrypto/cert.c
index 61908c7f048..249b59c1fae 100644
--- a/src/util/cert/libcrypto/cert.c
+++ b/src/util/cert/libcrypto/cert.c
@@ -20,6 +20,7 @@
 #include <openssl/x509.h>
 #include <openssl/bio.h>
 #include <openssl/pem.h>
+#include <openssl/core_names.h>
 
 #include "util/util.h"
 #include "util/sss_endian.h"
@@ -176,6 +177,94 @@ errno_t sss_cert_pem_to_der(TALLOC_CTX *mem_ctx, const char *pem,
 #define IDENTIFIER_NISTP384 "nistp384"
 #define IDENTIFIER_NISTP521 "nistp521"
 
+static int sss_ec_get_key(BN_CTX *bn_ctx, const EVP_PKEY *cert_pub_key,
+                          EC_GROUP **_ec_group, EC_POINT **_ec_public_key)
+{
+    EC_GROUP *ec_group = NULL;
+    EC_POINT *ec_public_key = NULL;
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    int ret;
+    static char curve_name[4096];
+    static unsigned char pubkey[4096];
+    size_t len;
+
+    ret = EVP_PKEY_get_utf8_string_param(cert_pub_key,
+                                         OSSL_PKEY_PARAM_GROUP_NAME,
+                                         curve_name, sizeof(curve_name), NULL);
+    if (ret != 1) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    ec_group = EC_GROUP_new_by_curve_name(OBJ_sn2nid(curve_name));
+    if (ec_group == NULL) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = EVP_PKEY_get_octet_string_param(cert_pub_key,
+                                          OSSL_PKEY_PARAM_PUB_KEY,
+                                          pubkey, sizeof(pubkey), &len);
+    if (ret != 1) {
+        EC_GROUP_free(ec_group);
+        ret = EINVAL;
+        goto done;
+    }
+
+    ec_public_key = EC_POINT_new(ec_group);
+    if (ec_public_key == NULL) {
+        EC_GROUP_free(ec_group);
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = EC_POINT_oct2point(ec_group, ec_public_key, pubkey, len, bn_ctx);
+    if (ret != 1) {
+        EC_GROUP_free(ec_group);
+        EC_POINT_free(ec_public_key);
+        ret = EINVAL;
+        goto done;
+    }
+
+#else
+    EC_KEY *ec_key = NULL;
+    const EC_GROUP *gr;
+    const EC_POINT *pk;
+
+    ec_key = EVP_PKEY_get0_EC_KEY(cert_pub_key);
+    if (ec_key == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    gr = EC_KEY_get0_group(ec_key);
+
+    pk = EC_KEY_get0_public_key(ec_key);
+
+    ec_group = EC_GROUP_dup(gr);
+    if (*_ec_group == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ec_public_key = EC_POINT_dup(pk, gr);
+    if (ec_public_key == NULL) {
+        EC_GROUP_free(ec_group);
+        ret = ENOMEM;
+        goto done;
+    }
+#endif
+
+    *_ec_group = ec_group;
+    *_ec_public_key = ec_public_key;
+
+    ret = EOK;
+
+done:
+    return ret;
+}
+
 static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
                                  uint8_t **key_blob, size_t *key_size)
 {
@@ -183,9 +272,8 @@ static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
     size_t c;
     uint8_t *buf = NULL;
     size_t buf_len;
-    EC_KEY *ec_key = NULL;
-    const EC_GROUP *ec_group = NULL;
-    const EC_POINT *ec_public_key = NULL;
+    EC_GROUP *ec_group = NULL;
+    EC_POINT *ec_public_key = NULL;
     BN_CTX *bn_ctx = NULL;
     int key_len;
     const char *identifier = NULL;
@@ -193,13 +281,18 @@ static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
     const char *header = NULL;
     int header_len;
 
-    ec_key = EVP_PKEY_get1_EC_KEY(cert_pub_key);
-    if (ec_key == NULL) {
+    bn_ctx =  BN_CTX_new();
+    if (bn_ctx == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "BN_CTX_new failed.\n");
         ret = ENOMEM;
         goto done;
     }
 
-    ec_group = EC_KEY_get0_group(ec_key);
+    ret = sss_ec_get_key(bn_ctx, cert_pub_key, &ec_group, &ec_public_key);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "Failed to get curve details.\n");
+        goto done;
+    }
 
     switch(EC_GROUP_get_curve_name(ec_group)) {
     case NID_X9_62_prime256v1:
@@ -224,15 +317,6 @@ static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
     header_len = strlen(header);
     identifier_len = strlen(identifier);
 
-    ec_public_key = EC_KEY_get0_public_key(ec_key);
-
-    bn_ctx =  BN_CTX_new();
-    if (bn_ctx == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, "BN_CTX_new failed.\n");
-        ret = ENOMEM;
-        goto done;
-    }
-
     key_len = EC_POINT_point2oct(ec_group, ec_public_key,
                              POINT_CONVERSION_UNCOMPRESSED, NULL, 0, bn_ctx);
     if (key_len == 0) {
@@ -279,7 +363,8 @@ static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
     }
 
     BN_CTX_free(bn_ctx);
-    EC_KEY_free(ec_key);
+    EC_GROUP_free(ec_group);
+    EC_POINT_free(ec_public_key);
 
     return ret;
 }
@@ -288,6 +373,69 @@ static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
 #define SSH_RSA_HEADER "ssh-rsa"
 #define SSH_RSA_HEADER_LEN (sizeof(SSH_RSA_HEADER) - 1)
 
+static int sss_rsa_get_key(const EVP_PKEY *cert_pub_key,
+                           BIGNUM **_n, BIGNUM **_e)
+{
+    int ret;
+    BIGNUM *n = NULL;
+    BIGNUM *e = NULL;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    ret = EVP_PKEY_get_bn_param(cert_pub_key, OSSL_PKEY_PARAM_RSA_N, &n);
+    if (ret != 1) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = EVP_PKEY_get_bn_param(cert_pub_key, OSSL_PKEY_PARAM_RSA_E, &e);
+    if (ret != 1) {
+        BN_clear_free(n);
+        ret = EINVAL;
+        goto done;
+    }
+
+#else
+
+    const BIGNUM *tmp_n;
+    const BIGNUM *tmp_e:
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+    const RSA *rsa_pub_key = NULL;
+    rsa_pub_key = EVP_PKEY_get0_RSA(cert_pub_key);
+    if (rsa_pub_key == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    RSA_get0_key(rsa_pub_key, tmp_n, tmp_e, NULL);
+#else
+    tmp_n = cert_pub_key->pkey.rsa->n;
+    tmp_e = cert_pub_key->pkey.rsa->e;
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+
+    *n = BN_dup(tmp_n);
+    if (*n == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    *e = BN_dup(tmp_e);
+    if (*e == NULL) {
+        BN_clear_free(n);
+        ret = ENOME;
+        goto done;
+    }
+
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+
+    *_e = e;
+    *_n = n;
+
+    ret = EOK;
+
+done:
+    return ret;
+}
+
 static errno_t rsa_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
                                   uint8_t **key_blob, size_t *key_size)
 {
@@ -295,26 +443,18 @@ static errno_t rsa_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
     size_t c;
     size_t size;
     uint8_t *buf = NULL;
-    const BIGNUM *n;
-    const BIGNUM *e;
+    BIGNUM *n = NULL;
+    BIGNUM *e = NULL;
     int modulus_len;
     unsigned char modulus[OPENSSL_RSA_MAX_MODULUS_BITS/8];
     int exponent_len;
     unsigned char exponent[OPENSSL_RSA_MAX_PUBEXP_BITS/8];
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-    const RSA *rsa_pub_key = NULL;
-    rsa_pub_key = EVP_PKEY_get0_RSA(cert_pub_key);
-    if (rsa_pub_key == NULL) {
-        ret = ENOMEM;
+    ret = sss_rsa_get_key(cert_pub_key, &n, &e);
+    if (ret != EOK) {
         goto done;
     }
 
-    RSA_get0_key(rsa_pub_key, &n, &e, NULL);
-#else
-    n = cert_pub_key->pkey.rsa->n;
-    e = cert_pub_key->pkey.rsa->e;
-#endif
     modulus_len = BN_bn2bin(n, modulus);
     exponent_len = BN_bn2bin(e, exponent);
 
@@ -358,6 +498,9 @@ static errno_t rsa_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
     ret = EOK;
 
 done:
+    BN_clear_free(n);
+    BN_clear_free(e);
+
     if (ret != EOK)  {
         talloc_free(buf);
     }

From a86ee649ac7cd80cfb3c1b50ae728fbf12d1b92a Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 18 Sep 2024 17:40:35 +0200
Subject: [PATCH 010/129] Require OpenSSL >= 1.0.1

:packaging:Support of OpenSSL older than 1.0.1 was dropped

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                                   |  1 -
 src/external/crypto.m4                        |  3 +-
 src/lib/certmap/sss_cert_content_crypto.c     |  7 ----
 src/p11_child/p11_child_openssl.c             | 13 -------
 src/util/cert/libcrypto/cert.c                |  6 ---
 .../crypto/libcrypto/crypto_sha512crypt.c     |  2 -
 src/util/crypto/libcrypto/sss_openssl.h       | 39 -------------------
 7 files changed, 2 insertions(+), 69 deletions(-)
 delete mode 100644 src/util/crypto/libcrypto/sss_openssl.h

diff --git a/Makefile.am b/Makefile.am
index 01e21792f94..61e34bbcf3f 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -700,7 +700,6 @@ dist_noinst_HEADERS = \
     src/sss_iface/sss_iface_sync.h \
     src/sss_iface/sss_iface.h \
     src/util/crypto/sss_crypto.h \
-    src/util/crypto/libcrypto/sss_openssl.h \
     src/util/cert.h \
     src/util/dlinklist.h \
     src/util/debug.h \
diff --git a/src/external/crypto.m4 b/src/external/crypto.m4
index b21645d17a7..284d15b269d 100644
--- a/src/external/crypto.m4
+++ b/src/external/crypto.m4
@@ -1,5 +1,6 @@
 AC_DEFUN([AM_CHECK_LIBCRYPTO],
-         [PKG_CHECK_MODULES([CRYPTO],[libcrypto])
+         [PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.1], [],
+                            [AC_MSG_ERROR([Please install libcrypto version 1.0.1 or greater])])
           PKG_CHECK_MODULES([SSL],[libssl])
 ])
 
diff --git a/src/lib/certmap/sss_cert_content_crypto.c b/src/lib/certmap/sss_cert_content_crypto.c
index 6141aa7bad1..e73f1f35a75 100644
--- a/src/lib/certmap/sss_cert_content_crypto.c
+++ b/src/lib/certmap/sss_cert_content_crypto.c
@@ -34,13 +34,6 @@
 #include "lib/certmap/sss_certmap.h"
 #include "lib/certmap/sss_certmap_int.h"
 
-/* backward compatible macros for OpenSSL < 1.1 */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define ASN1_STRING_get0_data(o) ASN1_STRING_data(o)
-#define X509_get_extension_flags(o) ((o)->ex_flags)
-#define X509_get_key_usage(o) ((o)->ex_kusage)
-#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
-
 #define OID_NTDS_CA_SECURITY_EXT "1.3.6.1.4.1.311.25.2"
 #define OID_NTDS_OBJECTSID "1.3.6.1.4.1.311.25.2.1"
 
diff --git a/src/p11_child/p11_child_openssl.c b/src/p11_child/p11_child_openssl.c
index c88f07e4e82..41992637fdb 100644
--- a/src/p11_child/p11_child_openssl.c
+++ b/src/p11_child/p11_child_openssl.c
@@ -132,15 +132,6 @@ static OCSP_RESPONSE *query_responder(BIO *cbio, const char *host,
     return rsp;
 }
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define TLS_client_method SSLv23_client_method
-#define X509_STORE_get0_objects(store) (store->objs)
-#define X509_OBJECT_get_type(object) (object->type)
-#define X509_OBJECT_get0_X509(object) (object->data.x509)
-#define EVP_MD_CTX_free EVP_MD_CTX_destroy
-#define X509_CRL_get0_nextUpdate(object) (object->crl->nextUpdate)
-#endif
-
 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
                                  const char *host, const char *path,
                                  char *port, int use_ssl,
@@ -593,11 +584,7 @@ errno_t init_p11_ctx(TALLOC_CTX *mem_ctx, const char *ca_db,
 
     /* See https://wiki.openssl.org/index.php/Library_Initialization for
      * details. */
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
     ret = OPENSSL_init_ssl(0, NULL);
-#else
-    ret = SSL_library_init();
-#endif
     if (ret != 1) {
         DEBUG(SSSDBG_FATAL_FAILURE, "Failed to initialize OpenSSL.\n");
         ret = EIO;
diff --git a/src/util/cert/libcrypto/cert.c b/src/util/cert/libcrypto/cert.c
index 249b59c1fae..c6594497e78 100644
--- a/src/util/cert/libcrypto/cert.c
+++ b/src/util/cert/libcrypto/cert.c
@@ -397,8 +397,6 @@ static int sss_rsa_get_key(const EVP_PKEY *cert_pub_key,
 
     const BIGNUM *tmp_n;
     const BIGNUM *tmp_e:
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
     const RSA *rsa_pub_key = NULL;
     rsa_pub_key = EVP_PKEY_get0_RSA(cert_pub_key);
     if (rsa_pub_key == NULL) {
@@ -407,10 +405,6 @@ static int sss_rsa_get_key(const EVP_PKEY *cert_pub_key,
     }
 
     RSA_get0_key(rsa_pub_key, tmp_n, tmp_e, NULL);
-#else
-    tmp_n = cert_pub_key->pkey.rsa->n;
-    tmp_e = cert_pub_key->pkey.rsa->e;
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 
     *n = BN_dup(tmp_n);
     if (*n == NULL) {
diff --git a/src/util/crypto/libcrypto/crypto_sha512crypt.c b/src/util/crypto/libcrypto/crypto_sha512crypt.c
index c816d26f184..8b080ec5828 100644
--- a/src/util/crypto/libcrypto/crypto_sha512crypt.c
+++ b/src/util/crypto/libcrypto/crypto_sha512crypt.c
@@ -29,8 +29,6 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 
-#include "sss_openssl.h"
-
 
 /* Define our magic string to mark salt for SHA512 "encryption" replacement. */
 const char sha512_salt_prefix[] = "$6$";
diff --git a/src/util/crypto/libcrypto/sss_openssl.h b/src/util/crypto/libcrypto/sss_openssl.h
deleted file mode 100644
index a2e2d8523e0..00000000000
--- a/src/util/crypto/libcrypto/sss_openssl.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
-    Authors:
-        Lukas Slebodnik <lslebodn@redhat.com>
-
-    Copyright (C) 2016 Red Hat
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#ifndef _SSS_LIBCRYTPO_SSS_OPENSSL_H_
-#define _SSS_LIBCRYTPO_SSS_OPENSSL_H_
-
-#include <openssl/evp.h>
-
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-
-/* EVP_MD_CTX_create and EVP_MD_CTX_destroy are deprecated macros
- * in openssl-1.1 but openssl-1.0 does not know anything about
- * newly added functions EVP_MD_CTX_new, EVP_MD_CTX_free in 1.1
- */
-
-# define EVP_MD_CTX_new() EVP_MD_CTX_create()
-# define EVP_MD_CTX_free(ctx) EVP_MD_CTX_destroy((ctx))
-
-#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
-
-
-#endif /* _SSS_LIBCRYTPO_SSS_OPENSSL_H_ */

From 67ba42c48abb9270982836310488e35d9fc1d451 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 18 Sep 2024 15:18:14 +0200
Subject: [PATCH 011/129] pam: only set SYSDB_LOCAL_SMARTCARD_AUTH to 'true'
 but never to 'false'.

The krb5 backend will only returns that Smartcard authentication is
available if a Smartcard is present. That means if the user
authenticates with a different method and a Smartcard is not present at
this time 'sc_allow' will be 'false' and might overwrite a 'true' value
written during a previous authentication attempt where a Smartcard was
present. To avoid this we only write 'true' values. Since the default if
SYSDB_LOCAL_SMARTCARD_AUTH is missing is 'false' local Smartcard
authentication (offline) will still only be enabled if online Smartcard
authentication was detected.

Resolves: https://github.com/SSSD/sssd/issues/7532

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
---
 src/responder/pam/pamsrv_cmd.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 1394147a0f3..941446d94b7 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -554,9 +554,22 @@ static errno_t set_local_auth_type(struct pam_auth_req *preq,
         goto fail;
     }
 
-    ret = sysdb_attrs_add_bool(attrs, SYSDB_LOCAL_SMARTCARD_AUTH, sc_allow);
-    if (ret != EOK) {
-        goto fail;
+    if (sc_allow) {
+        /* Only set SYSDB_LOCAL_SMARTCARD_AUTH to 'true' but never to
+         * 'false'. The krb5 backend will only returns that Smartcard
+         * authentication is available if a Smartcard is present. That means
+         * if the user authenticates with a different method and a Smartcard
+         * is not present at this time 'sc_allow' will be 'false' and might
+         * overwrite a 'true' value written during a previous authentication
+         * attempt where a Smartcard was present. To avoid this we only write
+         * 'true' values. Since the default if SYSDB_LOCAL_SMARTCARD_AUTH is
+         * missing is 'false' local Smartcard authentication (offline) will
+         * still only be enabled if online Smartcard authentication was
+         * detected. */
+        ret = sysdb_attrs_add_bool(attrs, SYSDB_LOCAL_SMARTCARD_AUTH, sc_allow);
+        if (ret != EOK) {
+            goto fail;
+        }
     }
 
     ret = sysdb_attrs_add_bool(attrs, SYSDB_LOCAL_PASSKEY_AUTH, passkey_allow);

From 69f63f1fa64bd9cc7c2ee1f8e8d736727b13b3be Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 6 Sep 2024 14:27:19 +0200
Subject: [PATCH 012/129] sdap: allow to provide user_map when looking up group
 memberships
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To allow to lookup group memberships of other objects similar to user
objects but with different attribute mappings, e.g. host objects in AD,
a new option to provide an alternative attribute map is added.

Resolves: https://github.com/SSSD/sssd/issues/7590

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/providers/ad/ad_gpo.c                  |  2 +-
 src/providers/ldap/ldap_common.h           |  2 +
 src/providers/ldap/ldap_id.c               |  9 ++++
 src/providers/ldap/sdap_async.h            |  2 +
 src/providers/ldap/sdap_async_initgroups.c | 51 ++++++++++++++--------
 5 files changed, 48 insertions(+), 18 deletions(-)

diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
index 439f9a92124..46034edf59a 100644
--- a/src/providers/ad/ad_gpo.c
+++ b/src/providers/ad/ad_gpo.c
@@ -2247,7 +2247,7 @@ ad_gpo_connect_done(struct tevent_req *subreq)
                                  search_bases,
                                  state->host_fqdn,
                                  BE_FILTER_NAME,
-                                 NULL,
+                                 NULL, NULL, 0,
                                  true,
                                  true);
     tevent_req_set_callback(subreq, ad_gpo_target_dn_retrieval_done, req);
diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
index a2798758112..6832e12399d 100644
--- a/src/providers/ldap/ldap_common.h
+++ b/src/providers/ldap/ldap_common.h
@@ -313,6 +313,8 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                        const char *filter_value,
                                        int filter_type,
                                        const char *extra_value,
+                                       struct sdap_attr_map *user_map,
+                                       size_t user_map_cnt,
                                        bool noexist_delete,
                                        bool set_non_posix);
 
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index 4cc8afe7a9c..35dd5b14a28 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -1149,6 +1149,8 @@ struct groups_by_user_state {
     const char *filter_value;
     int filter_type;
     const char *extra_value;
+    struct sdap_attr_map *user_map;
+    size_t user_map_cnt;
     const char **attrs;
     bool non_posix;
 
@@ -1170,6 +1172,8 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                        const char *filter_value,
                                        int filter_type,
                                        const char *extra_value,
+                                       struct sdap_attr_map *user_map,
+                                       size_t user_map_cnt,
                                        bool noexist_delete,
                                        bool set_non_posix)
 {
@@ -1197,6 +1201,8 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
     state->filter_value = filter_value;
     state->filter_type = filter_type;
     state->extra_value = extra_value;
+    state->user_map = user_map;
+    state->user_map_cnt = user_map_cnt;
     state->domain = sdom->dom;
     state->sysdb = sdom->dom->sysdb;
     state->search_bases = search_bases;
@@ -1261,6 +1267,8 @@ static void groups_by_user_connect_done(struct tevent_req *subreq)
                                   state->sdom,
                                   sdap_id_op_handle(state->op),
                                   state->ctx,
+                                  state->user_map,
+                                  state->user_map_cnt,
                                   state->conn,
                                   state->search_bases,
                                   state->filter_value,
@@ -1462,6 +1470,7 @@ sdap_handle_acct_req_send(TALLOC_CTX *mem_ctx,
                                      ar->filter_value,
                                      ar->filter_type,
                                      ar->extra_value,
+                                     NULL, 0,
                                      noexist_delete, false);
         break;
 
diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
index de277e047fe..a78a1157ccc 100644
--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
@@ -158,6 +158,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_domain *sdom,
                                         struct sdap_handle *sh,
                                         struct sdap_id_ctx *id_ctx,
+                                        struct sdap_attr_map *user_map,
+                                        size_t user_map_cnt,
                                         struct sdap_id_conn_ctx *conn,
                                         struct sdap_search_base **search_bases,
                                         const char *name,
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index fb3d8fe2462..8ce1f6cd484 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -785,6 +785,8 @@ struct sdap_initgr_nested_state {
     struct tevent_context *ev;
     struct sysdb_ctx *sysdb;
     struct sdap_options *opts;
+    struct sdap_attr_map *user_map;
+    size_t user_map_cnt;
     struct sss_domain_info *dom;
     struct sdap_handle *sh;
 
@@ -812,6 +814,8 @@ static void sdap_initgr_nested_store(struct tevent_req *req);
 static struct tevent_req *sdap_initgr_nested_send(TALLOC_CTX *memctx,
                                                   struct tevent_context *ev,
                                                   struct sdap_options *opts,
+                                                  struct sdap_attr_map *user_map,
+                                                  size_t user_map_cnt,
                                                   struct sysdb_ctx *sysdb,
                                                   struct sss_domain_info *dom,
                                                   struct sdap_handle *sh,
@@ -828,6 +832,8 @@ static struct tevent_req *sdap_initgr_nested_send(TALLOC_CTX *memctx,
 
     state->ev = ev;
     state->opts = opts;
+    state->user_map = user_map;
+    state->user_map_cnt = user_map_cnt;
     state->sysdb = sysdb;
     state->dom = dom;
     state->sh = sh;
@@ -968,7 +974,7 @@ static errno_t sdap_initgr_nested_deref_search(struct tevent_req *req)
 
     subreq = sdap_deref_search_send(state, state->ev, state->opts,
                     state->sh, state->orig_dn,
-                    state->opts->user_map[SDAP_AT_USER_MEMBEROF].name,
+                    state->user_map[SDAP_AT_USER_MEMBEROF].name,
                     sdap_attrs, num_maps, maps, timeout);
     if (!subreq) {
         ret = EIO;
@@ -2697,6 +2703,8 @@ struct sdap_get_initgr_state {
     struct tevent_context *ev;
     struct sysdb_ctx *sysdb;
     struct sdap_options *opts;
+    struct sdap_attr_map *user_map;
+    size_t user_map_cnt;
     struct sss_domain_info *dom;
     struct sdap_domain *sdom;
     struct sdap_handle *sh;
@@ -2731,6 +2739,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_domain *sdom,
                                         struct sdap_handle *sh,
                                         struct sdap_id_ctx *id_ctx,
+                                        struct sdap_attr_map *user_map,
+                                        size_t user_map_cnt,
                                         struct sdap_id_conn_ctx *conn,
                                         struct sdap_search_base **search_bases,
                                         const char *filter_value,
@@ -2754,6 +2764,12 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
 
     state->ev = ev;
     state->opts = id_ctx->opts;
+    state->user_map = user_map;
+    state->user_map_cnt = user_map_cnt;
+    if (state->user_map == NULL) {
+        state->user_map = id_ctx->opts->user_map;
+        state->user_map_cnt = id_ctx->opts->user_map_cnt;
+    }
     state->dom = sdom->dom;
     state->sysdb = sdom->dom->sysdb;
     state->sdom = sdom;
@@ -2785,7 +2801,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
 
     switch (filter_type) {
     case BE_FILTER_SECID:
-        search_attr =  state->opts->user_map[SDAP_AT_USER_OBJECTSID].name;
+        search_attr =  state->user_map[SDAP_AT_USER_OBJECTSID].name;
 
         ret = sss_filter_sanitize(state, state->filter_value, &clean_name);
         if (ret != EOK) {
@@ -2794,7 +2810,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
         }
         break;
     case BE_FILTER_UUID:
-        search_attr =  state->opts->user_map[SDAP_AT_USER_UUID].name;
+        search_attr =  state->user_map[SDAP_AT_USER_UUID].name;
 
         ret = sss_filter_sanitize(state, state->filter_value, &clean_name);
         if (ret != EOK) {
@@ -2812,23 +2828,23 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
             }
 
             ep_filter = get_enterprise_principal_string_filter(state,
-                                 state->opts->user_map[SDAP_AT_USER_PRINC].name,
+                                 state->user_map[SDAP_AT_USER_PRINC].name,
                                  clean_name, state->opts->basic);
             state->user_base_filter =
                     talloc_asprintf(state,
                                  "(&(|(%s=%s)(%s=%s)%s)(objectclass=%s)",
-                                 state->opts->user_map[SDAP_AT_USER_PRINC].name,
+                                 state->user_map[SDAP_AT_USER_PRINC].name,
                                  clean_name,
-                                 state->opts->user_map[SDAP_AT_USER_EMAIL].name,
+                                 state->user_map[SDAP_AT_USER_EMAIL].name,
                                  clean_name,
                                  ep_filter == NULL ? "" : ep_filter,
-                                 state->opts->user_map[SDAP_OC_USER].name);
+                                 state->user_map[SDAP_OC_USER].name);
             if (state->user_base_filter == NULL) {
                 talloc_zfree(req);
                 return NULL;
             }
         } else {
-            search_attr = state->opts->user_map[SDAP_AT_USER_NAME].name;
+            search_attr = state->user_map[SDAP_AT_USER_NAME].name;
 
             ret = sss_parse_internal_fqname(state, filter_value,
                                             &state->shortname, NULL);
@@ -2860,7 +2876,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
         state->user_base_filter =
                 talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)",
                                 search_attr, clean_name,
-                                state->opts->user_map[SDAP_OC_USER].name);
+                                state->user_map[SDAP_OC_USER].name);
         if (!state->user_base_filter) {
             talloc_zfree(req);
             return NULL;
@@ -2877,14 +2893,14 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
          */
         state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
                                         "(%s=*))",
-                                        id_ctx->opts->user_map[SDAP_AT_USER_OBJECTSID].name);
+                                        state->user_map[SDAP_AT_USER_OBJECTSID].name);
     } else {
         /* When not ID-mapping or looking up app users, make sure there
          * is a non-NULL UID */
         state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
                                         "(&(%s=*)(!(%s=0))))",
-                                        id_ctx->opts->user_map[SDAP_AT_USER_UID].name,
-                                        id_ctx->opts->user_map[SDAP_AT_USER_UID].name);
+                                        state->user_map[SDAP_AT_USER_UID].name,
+                                        state->user_map[SDAP_AT_USER_UID].name);
     }
     if (!state->user_base_filter) {
         talloc_zfree(req);
@@ -2892,8 +2908,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
     }
 
     ret = build_attrs_from_map(state,
-                               state->opts->user_map,
-                               state->opts->user_map_cnt,
+                               state->user_map,
+                               state->user_map_cnt,
                                NULL, &state->user_attrs, NULL);
     if (ret) {
         talloc_zfree(req);
@@ -2990,7 +3006,7 @@ static errno_t sdap_get_initgr_next_base(struct tevent_req *req)
             state->user_search_bases[state->user_base_iter]->basedn,
             state->user_search_bases[state->user_base_iter]->scope,
             state->filter, state->user_attrs,
-            state->opts->user_map, state->opts->user_map_cnt,
+            state->user_map, state->user_map_cnt,
             state->timeout,
             false);
     if (!subreq) {
@@ -3179,6 +3195,7 @@ static void sdap_get_initgr_user(struct tevent_req *subreq)
 
     case SDAP_SCHEMA_IPA_V1:
         subreq = sdap_initgr_nested_send(state, state->ev, state->opts,
+                                         state->user_map, state->user_map_cnt,
                                          state->sysdb, state->dom, state->sh,
                                          state->orig_user, state->grp_attrs);
         if (!subreq) {
@@ -3377,7 +3394,7 @@ static void sdap_get_initgr_done(struct tevent_req *subreq)
          */
         ret = sdap_attrs_get_sid_str(
                 tmp_ctx, opts->idmap_ctx, state->orig_user,
-                opts->user_map[SDAP_AT_USER_OBJECTSID].sys_name,
+                state->user_map[SDAP_AT_USER_OBJECTSID].sys_name,
                 &sid_str);
         if (ret != EOK) goto done;
 
@@ -3392,7 +3409,7 @@ static void sdap_get_initgr_done(struct tevent_req *subreq)
 
         ret = sysdb_attrs_get_uint32_t(
                 state->orig_user,
-                opts->user_map[SDAP_AT_USER_PRIMARY_GROUP].sys_name,
+                state->user_map[SDAP_AT_USER_PRIMARY_GROUP].sys_name,
                 &primary_gid);
         if (ret != EOK) {
             DEBUG(SSSDBG_MINOR_FAILURE,

From 5f5077ac1158deff6fbb51722d37b9c5f8b05cf7 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 6 Sep 2024 14:37:05 +0200
Subject: [PATCH 013/129] ad: use default user_map when looking of host groups
 for GPO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the default AD user attribute map to lookup the group membership of
the AD host object. This should help to avoid issues if user attributes
are overwritten in the user attribute map.

Resolves: https://github.com/SSSD/sssd/issues/7590

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/providers/ad/ad_access.h |  1 +
 src/providers/ad/ad_gpo.c    | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/providers/ad/ad_access.h b/src/providers/ad/ad_access.h
index 34d5597da92..c54b53eed01 100644
--- a/src/providers/ad/ad_access.h
+++ b/src/providers/ad/ad_access.h
@@ -49,6 +49,7 @@ struct ad_access_ctx {
     } gpo_map_type;
     hash_table_t *gpo_map_options_table;
     enum gpo_map_type gpo_default_right;
+    struct sdap_attr_map *host_attr_map;
 };
 
 struct tevent_req *
diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
index 46034edf59a..20f863bc07e 100644
--- a/src/providers/ad/ad_gpo.c
+++ b/src/providers/ad/ad_gpo.c
@@ -45,6 +45,7 @@
 #include "providers/ad/ad_common.h"
 #include "providers/ad/ad_domain_info.h"
 #include "providers/ad/ad_gpo.h"
+#include "providers/ad/ad_opts.h"
 #include "providers/ldap/sdap_access.h"
 #include "providers/ldap/sdap_async.h"
 #include "providers/ldap/sdap.h"
@@ -2241,13 +2242,25 @@ ad_gpo_connect_done(struct tevent_req *subreq)
               "trying with user search base.");
     }
 
+    if (state->access_ctx->host_attr_map == NULL) {
+        ret = sdap_copy_map(state->access_ctx,
+                            ad_2008r2_user_map, SDAP_OPTS_USER,
+                            &state->access_ctx->host_attr_map);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "Failed to copy user map.\n");
+            goto done;
+        }
+    }
+
     subreq = groups_by_user_send(state, state->ev,
                                  state->access_ctx->ad_id_ctx->sdap_id_ctx,
                                  sdom, state->conn,
                                  search_bases,
                                  state->host_fqdn,
                                  BE_FILTER_NAME,
-                                 NULL, NULL, 0,
+                                 NULL,
+                                 state->access_ctx->host_attr_map,
+                                 SDAP_OPTS_USER,
                                  true,
                                  true);
     tevent_req_set_callback(subreq, ad_gpo_target_dn_retrieval_done, req);

From f6ad1828cf0d59e48734a52b29549e53e33b65f3 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 20 Sep 2024 11:41:33 +0200
Subject: [PATCH 014/129] SYSTEMD: chown gpo-cache as well
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 Makefile.am                      | 3 ++-
 contrib/sssd.spec.in             | 1 +
 src/sysv/systemd/sssd.service.in | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 61e34bbcf3f..627593f2aa5 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5296,7 +5296,8 @@ edit_cmd = $(SED) \
         -e 's|@supplementary_groups[@]|$(supplementary_groups)|g' \
         -e 's|@sssdconfdir[@]|$(sssdconfdir)|g' \
         -e 's|@secdbpath[@]|$(secdbpath)|g' \
-        -e 's|@dbpath[@]|$(dbpath)|g'
+        -e 's|@dbpath[@]|$(dbpath)|g' \
+        -e 's|@gpocachepath[@]|$(gpocachepath)|g'
 
 replace_script = \
     @rm -f $@ $@.tmp; \
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 90bb5bbdd0e..67e8dcba2b5 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -1122,6 +1122,7 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us
 %__chown -f -R %{sssd_user}:%{sssd_user} %{_sysconfdir}/sssd/conf.d || true
 %__chown -f %{sssd_user}:%{sssd_user} %{_var}/log/%{name}/*.log || true
 %__chown -f %{sssd_user}:%{sssd_user} %{secdbpath}/*.ldb || true
+%__chown -f %{sssd_user}:%{sssd_user} %{gpocachepath}/* || true
 
 %preun common
 %systemd_preun sssd.service
diff --git a/src/sysv/systemd/sssd.service.in b/src/sysv/systemd/sssd.service.in
index 5fd01a2ecef..37e0a63f87e 100644
--- a/src/sysv/systemd/sssd.service.in
+++ b/src/sysv/systemd/sssd.service.in
@@ -15,6 +15,7 @@ ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/sssd.conf
 ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/conf.d
 ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/pki
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @dbpath@/*.ldb"
+ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @gpocachepath@/*"
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/*.log"
 ExecStart=@sbindir@/sssd -i ${DEBUG_LOGGER}
 Type=notify

From 823d7870258c6090769816ae95ba3a0b1f1f1404 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Fri, 20 Sep 2024 12:55:44 +0200
Subject: [PATCH 015/129] SSH: sss_ssh_knownhosts must accept port numbers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sss_ssh_knownhosts was only accepting a hostname or IP address, but no
port number. Because token %H of ssh(1) could pass a port number, it
must be accepted.

The %H token can provide the hostname and port number in the
following format:

hostname
canonical.host.name
IP-address
[hostname]:port
[canonical.host.name]:port
[IP-address]:port

The port is specified only when a non-default port is used.

Identifiers without the brackets are also recognized in case a user
invokes the tool directly.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/man/sss_ssh_knownhosts.1.xml             |  40 +++++-
 src/sss_client/ssh/sss_ssh_authorizedkeys.c  |   2 +-
 src/sss_client/ssh/sss_ssh_knownhosts.c      | 129 ++++++++++++++-----
 src/sss_client/ssh/sss_ssh_knownhostsproxy.c |   2 +-
 src/tests/system/tests/test_ipa.py           |  13 +-
 src/util/sss_ssh.c                           |  59 ++++++++-
 src/util/sss_ssh.h                           |   3 +-
 7 files changed, 204 insertions(+), 44 deletions(-)

diff --git a/src/man/sss_ssh_knownhosts.1.xml b/src/man/sss_ssh_knownhosts.1.xml
index f9541604e43..bd3aa87f635 100644
--- a/src/man/sss_ssh_knownhosts.1.xml
+++ b/src/man/sss_ssh_knownhosts.1.xml
@@ -44,7 +44,7 @@
             key host authentication using the <quote>KnownHostsCommand</quote>
             option:
             <programlisting>
-              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H
+                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H
             </programlisting>
             Please refer to the <citerefentry>
             <refentrytitle>ssh_config</refentrytitle><manvolnum>5</manvolnum>
@@ -67,10 +67,48 @@
                     </para>
                 </listitem>
             </varlistentry>
+            <varlistentry>
+                <term>
+                    <option>-o</option>,<option>--only-host-name</option>
+                </term>
+                <listitem>
+                    <para>
+                        When the keys retrieved from the backend do not include
+                        the hostname, this tool will add the unmodified hostname
+                        as provided by the caller. If this flag is set, only the
+                        hostname (no port number) will be added to the keys.
+                    </para>
+                </listitem>
+            </varlistentry>
             <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/param_help.xml" />
         </variablelist>
     </refsect1>
 
+    <refsect1 id='key_retrieval'>
+        <title>KEY RETRIEVAL</title>
+        <para>
+            The key lines retrieved from the backend are expected to respect the
+            key format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote>
+            section of <citerefentry><refentrytitle>sshd</refentrytitle>
+            <manvolnum>8</manvolnum></citerefentry>. However, returning only
+            the keytype and the key itself is tolerated, in which case, the
+            hostname received as parameter will be added before the keytype to
+            output a correctly formatted line. The hostname will be added
+            unmodified or just the hostname (no port number), depending on
+            whether the <option>-o</option>,<option>--only-host-name</option>
+            option was provided.
+        </para>
+        <para>
+            When the SSH server is listening on a non-default port, the
+            backend MUST provide the hostname including the port number in the
+            correct format and position as part of the key line. For example,
+            the minimal key line would be:
+            <programlisting>
+                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;
+            </programlisting>
+        </para>
+    </refsect1>
+
     <refsect1 id='exit_status'>
         <title>EXIT STATUS</title>
         <para>
diff --git a/src/sss_client/ssh/sss_ssh_authorizedkeys.c b/src/sss_client/ssh/sss_ssh_authorizedkeys.c
index 0e8256cc7b4..35374384428 100644
--- a/src/sss_client/ssh/sss_ssh_authorizedkeys.c
+++ b/src/sss_client/ssh/sss_ssh_authorizedkeys.c
@@ -107,7 +107,7 @@ int main(int argc, const char **argv)
 
     /* print results */
     for (i = 0; i < ent->num_pubkeys; i++) {
-        ret = sss_ssh_print_pubkey(&ent->pubkeys[i], NULL);
+        ret = sss_ssh_print_pubkey(&ent->pubkeys[i], NULL, NULL);
         if (ret != EOK && ret != EINVAL) {
             DEBUG(SSSDBG_CRIT_FAILURE,
                   "ssh_ssh_print_pubkey() failed (%d): %s\n",
diff --git a/src/sss_client/ssh/sss_ssh_knownhosts.c b/src/sss_client/ssh/sss_ssh_knownhosts.c
index b2860be4e19..7dd08c22945 100644
--- a/src/sss_client/ssh/sss_ssh_knownhosts.c
+++ b/src/sss_client/ssh/sss_ssh_knownhosts.c
@@ -29,33 +29,92 @@
 #include "sss_client/sss_cli.h"
 #include "sss_client/ssh/sss_ssh_client.h"
 
+
+/*
+ * Parse the received hostname, which is expected in the format described in
+ * the “SSH_KNOWN_HOSTS FILE FORMAT” section of sshd(8). The parsed host name
+ * and port are returned as strings allocated with malloc(3), and not talloc(3),
+ * and must be freed by the caller.
+ *
+ * Some of the recognized formats are not expected from ssh, but it is easier
+ * to identify them and useful in the case the tool is launched manually by a
+ * user.
+ *
+ * If any of the expected values (host or port) is not found, their respective
+ * output arguments will NOT be modified.
+ */
+static errno_t parse_ssh_host(const char *ssh_host,
+                              const char **_host, const char **_port)
+{
+    int values;
+
+    /* Host name between brackets and with a port number.
+     * ssh can use this format.
+     */
+    values = sscanf(ssh_host, "[%m[^]]]:%ms", _host, _port);
+    if (values == 2) {
+        return EOK;
+    }
+    /* Just a host name enclosed between brackets.
+     * ssh is not expected to use this format but... who knows?
+     */
+    if (values == 1) {
+        return EOK;
+    }
+
+    /* A host name without brackets but with a port number.
+     * This is not expected from ssh, but users will certainly use it.
+     */
+    values = sscanf(ssh_host, "%m[^:]:%ms", _host, _port);
+    if (values == 2) {
+        return EOK;
+    }
+    /* A host name without brackets or port number.
+     * This is probably the most common case.
+     */
+    if (values == 1) {
+        return EOK;
+    }
+
+    return EINVAL;
+}
+
 static errno_t known_hosts(TALLOC_CTX *mem_ctx, const char *domain,
-                           const char *host, struct sss_ssh_ent **_ent)
+                           const char *ssh_host, int only_host_name)
 {
     errno_t ret;
     struct addrinfo ai_hint;
     struct addrinfo *ai = NULL;
     char canonhost[NI_MAXHOST];
+    const char *host = NULL;
+    const char *port = NULL;
     const char *canonname = NULL;
     struct sss_ssh_ent *ent = NULL;
+    size_t i;
 
-    if (_ent == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "NULL _ent received\n");
-        ERROR("Internal error\n");
-        return EINVAL;
+    /* WARNING:
+     * Memory for host and port is allocated with malloc(3) instead of talloc(3)
+     */
+    ret = parse_ssh_host(ssh_host, &host, &port);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Failed to parse the host name: %s\n", ssh_host);
+        goto done;
     }
+    DEBUG(SSSDBG_FUNC_DATA, "Parsed hostname: %s, port: %s\n",
+          host, port == NULL ? "default" : port);
 
+    /* Canonicalize the host name in case the user used an alias or IP address */
     memset(&ai_hint, 0, sizeof(struct addrinfo));
     ai_hint.ai_family = AF_UNSPEC;
     ai_hint.ai_socktype = SOCK_STREAM;
     ai_hint.ai_protocol = IPPROTO_TCP;
     ai_hint.ai_flags = AI_NUMERICHOST;
 
-    DEBUG(SSSDBG_FUNC_DATA, "Looking up canonical name for: %s\n", host);
-    ret = getaddrinfo(host, NULL, &ai_hint, &ai);
+    ret = getaddrinfo(host, port, &ai_hint, &ai);
     if (ret != EOK) {
         ai_hint.ai_flags = AI_CANONNAME;
-        ret = getaddrinfo(host, NULL, &ai_hint, &ai);
+        ret = getaddrinfo(host, port, &ai_hint, &ai);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE,
                   "getaddrinfo() failed (%d): %s\n", ret, gai_strerror(ret));
@@ -65,7 +124,7 @@ static errno_t known_hosts(TALLOC_CTX *mem_ctx, const char *domain,
         }
     } else {
         ret = getnameinfo(ai->ai_addr, ai->ai_addrlen,
-                          canonhost, NI_MAXHOST, NULL, 0, NI_NAMEREQD);
+                          canonhost, sizeof(canonhost), NULL, 0, NI_NAMEREQD);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE,
                   "getnameinfo() failed (%d): %s\n", ret, gai_strerror(ret));
@@ -89,10 +148,28 @@ static errno_t known_hosts(TALLOC_CTX *mem_ctx, const char *domain,
         goto done;
     }
 
-    *_ent = ent;
+    /* Print the results.
+     * We pass the host name to handle the case when the key doesn't include
+     * the host name */
+    for (i = 0; i < ent->num_pubkeys; i++) {
+        ret = sss_ssh_print_pubkey(&ent->pubkeys[i],
+                                   only_host_name ? host : ssh_host,
+                                   host);
+        if (ret != EOK && ret != EINVAL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "ssh_ssh_print_pubkey() failed (%d): %s\n",
+                  ret, strerror(ret));
+            goto done;
+        }
+    }
+
     ret = EOK;
 
 done:
+    talloc_free(ent);
+    /* These two strings were allocated with malloc() */
+    free(discard_const(host));
+    free(discard_const(port));
     if (ai != NULL) {
         freeaddrinfo(ai);
     }
@@ -103,6 +180,7 @@ int main(int argc, const char **argv)
 {
     TALLOC_CTX *mem_ctx = NULL;
     int pc_debug = SSSDBG_TOOLS_DEFAULT;
+    int pc_only_host_name = false;
     const char *pc_domain = NULL;
     const char *pc_host = NULL;
     struct poptOption long_options[] = {
@@ -110,12 +188,12 @@ int main(int argc, const char **argv)
         { "debug", '\0', POPT_ARG_INT | POPT_ARGFLAG_DOC_HIDDEN, &pc_debug, 0,
           _("The debug level to run with"), NULL },
         { "domain", 'd', POPT_ARG_STRING, &pc_domain, 0,
-          _("The SSSD domain to use"), NULL },
+          _("The SSSD domain to use"), _("domain name") },
+        { "only-host-name", 'o', POPT_ARG_VAL, &pc_only_host_name, true,
+          _("When the key has no host name, add only the host name"), NULL },
         POPT_TABLEEND
     };
     poptContext pc = NULL;
-    struct sss_ssh_ent *ent;
-    size_t i;
     int ret;
     errno_t res;
 
@@ -154,30 +232,19 @@ int main(int argc, const char **argv)
         BAD_POPT_PARAMS(pc, _("Host not specified\n"), ret, fini);
     }
 
-    /* look up the public keys */
-    res = known_hosts(mem_ctx, pc_domain, pc_host, &ent);
-    if (res != EOK) {
-        /* On a successful execution, even if no key was found,
-         * ssh expects EXIT_SUCCESS. */
-        ret = (res == ENOENT ? EXIT_SUCCESS : EXIT_FAILURE);
-        goto fini;
-    }
-
     /* If the other side closes its end of the pipe, we don't want this tool
      * to exit abruptly, but to finish gracefully instead because the valid
      * key can be present in the data already written
      */
     signal(SIGPIPE, SIG_IGN);
 
-    /* print results */
-    for (i = 0; i < ent->num_pubkeys; i++) {
-        ret = sss_ssh_print_pubkey(&ent->pubkeys[i], pc_host);
-        if (ret != EOK && ret != EINVAL) {
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "ssh_ssh_print_pubkey() failed (%d): %s\n",
-                  ret, strerror(ret));
-            goto fini;
-        }
+    /* look up the public keys */
+    res = known_hosts(mem_ctx, pc_domain, pc_host, pc_only_host_name);
+    if (res != EOK) {
+        /* On a successful execution, even if no key was found,
+         * ssh expects EXIT_SUCCESS. */
+        ret = (res == ENOENT ? EXIT_SUCCESS : EXIT_FAILURE);
+        goto fini;
     }
 
     ret = EXIT_SUCCESS;
diff --git a/src/sss_client/ssh/sss_ssh_knownhostsproxy.c b/src/sss_client/ssh/sss_ssh_knownhostsproxy.c
index 4d1ccbed9d8..7b58926dd7c 100644
--- a/src/sss_client/ssh/sss_ssh_knownhostsproxy.c
+++ b/src/sss_client/ssh/sss_ssh_knownhostsproxy.c
@@ -310,7 +310,7 @@ int main(int argc, const char **argv)
         /* print results */
         if (ent != NULL) {
             for (size_t i = 0; i < ent->num_pubkeys; i++) {
-                ret = sss_ssh_print_pubkey(&ent->pubkeys[i], NULL);
+                ret = sss_ssh_print_pubkey(&ent->pubkeys[i], NULL, NULL);
                 if (ret != EOK && ret != EINVAL) {
                     DEBUG(SSSDBG_CRIT_FAILURE,
                           "ssh_ssh_print_pubkey() failed (%d): %s\n",
diff --git a/src/tests/system/tests/test_ipa.py b/src/tests/system/tests/test_ipa.py
index 1b5bd2a08fa..c564ff9b619 100644
--- a/src/tests/system/tests/test_ipa.py
+++ b/src/tests/system/tests/test_ipa.py
@@ -51,7 +51,7 @@ def test_ipa__hostpublickeys_by_name(client: Client, ipa: IPA, public_keys: list
         1. All public keys were printed
     :customerscenario: False
     """
-    hostname = f"ssh.{ipa.domain}"
+    hostname = f"ssh-host.{ipa.domain}"
     ip = "10.255.251.10"
 
     ipa.host_account(hostname).add(ip=ip, sshpubkey=public_keys)
@@ -76,12 +76,13 @@ def test_ipa__hostpublickeys_by_shortname(client: Client, ipa: IPA, public_keys:
         2. Configure SSSD with SSH responder
         3. Start SSSD
     :steps:
-        1. Lookup SSH key by running "sss_ssh_knownhosts ssh"
+        1. Lookup SSH key by running "sss_ssh_knownhosts ssh-host"
     :expectedresults:
         1. All public keys were printed
     :customerscenario: False
     """
-    hostname = f"ssh.{ipa.domain}"
+    shortname = "ssh-host"
+    hostname = f"{shortname}.{ipa.domain}"
     ip = "10.255.251.10"
     ipa.host_account(hostname).add(ip=ip, sshpubkey=public_keys)
 
@@ -89,11 +90,11 @@ def test_ipa__hostpublickeys_by_shortname(client: Client, ipa: IPA, public_keys:
     client.sssd.enable_responder("ssh")
     client.sssd.start()
 
-    result = client.sss_ssh_knownhosts("ssh")
+    result = client.sss_ssh_knownhosts(shortname)
     assert result.rc == 0, "Did not get OpenSSH known hosts public keys!"
     assert len(public_keys) == len(result.stdout_lines), "Did not get expected number of public keys!"
     for key in public_keys:
-        assert f"ssh {key}" in result.stdout_lines, "Did not get expected public keys!"
+        assert f"{shortname} {key}" in result.stdout_lines, "Did not get expected public keys!"
 
 
 @pytest.mark.ticket(gh=5518)
@@ -112,7 +113,7 @@ def test_ipa__hostpublickeys_by_ip(client: Client, ipa: IPA, public_keys: list[s
         1. All public keys were printed
     :customerscenario: False
     """
-    hostname = f"ssh.{ipa.domain}"
+    hostname = f"ssh-host.{ipa.domain}"
     ip = "10.255.251.10"
     ipa.host_account(hostname).add(ip=ip, sshpubkey=public_keys)
 
diff --git a/src/util/sss_ssh.c b/src/util/sss_ssh.c
index f9c0918fdbb..4e25a263148 100644
--- a/src/util/sss_ssh.c
+++ b/src/util/sss_ssh.c
@@ -18,6 +18,9 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#define _GNU_SOURCE
+
+#include <string.h>
 #include <arpa/inet.h>
 
 #include "db/sysdb.h"
@@ -25,6 +28,43 @@
 #include "util/crypto/sss_crypto.h"
 #include "util/sss_ssh.h"
 
+
+/* Check if the key_line we received from the backend includes the hostname or
+ * it is just the keytype and the key.
+ *
+ * Key lines have this format:
+ * marker (optional), hostnames, keytype, base64-encoded key, comment (optional)
+ *
+ * This is a very simplistic method based on looking for the provided hostname
+ * into the provided keyline, at the right position (the hostname could also
+ * be present in the comment at the end).
+ */
+static bool
+sss_ssh_key_has_host_name(const char *key_line, const char *hostname)
+{
+    const char *current = key_line;
+    const char *end;
+
+    /* Skip spaces */
+    while (*current == ' ') {
+        current++;
+    };
+    if (*current == '@') {
+        /* If the optional marker is present, we assume the host name is present too */
+        return true;
+    }
+
+    /* We are supposed to be here at the beginning of the hostnames. Are we?
+     * Look for the next space, which is a separator. If the hostname list
+     * is present, it must happen before that space and include the expected
+     * hostname.
+     */
+    end = strchrnul(current, ' ');
+    current = memmem(current, end - current, hostname, strlen(hostname));
+    return (current != NULL);
+}
+
+
 errno_t
 sss_ssh_make_ent(TALLOC_CTX *mem_ctx,
                  struct ldb_message *msg,
@@ -218,8 +258,19 @@ sss_ssh_format_pubkey(TALLOC_CTX *mem_ctx,
     return ret;
 }
 
+/*
+ * Print the public key in the expected format.
+ *
+ * pubkey:     The structure storing the public key.
+ * keyhost:    The hostname that will be added in front of the textual key,
+ *             if needed.
+ * needlehost: The hostname that will be looked for into the textual key to
+ *             know whether the hostname is present. Ignored if keyhost is NULL;
+ *             cannot be NULL otherwise.
+ */
 errno_t
-sss_ssh_print_pubkey(struct sss_ssh_pubkey *pubkey, const char *keyhost)
+sss_ssh_print_pubkey(struct sss_ssh_pubkey *pubkey, const char *keyhost,
+                     const char *needlehost)
 {
     TALLOC_CTX *tmp_ctx;
     char *repr = NULL;
@@ -240,8 +291,10 @@ sss_ssh_print_pubkey(struct sss_ssh_pubkey *pubkey, const char *keyhost)
         goto end;
     }
 
-    /* OpenSSH expects a linebreak after each key */
-    if (keyhost == NULL) {
+    /* Check if the host name part is included with the key.
+     * OpenSSH expects a linebreak after each key. */
+    if (keyhost == NULL || needlehost == NULL
+        || sss_ssh_key_has_host_name(repr, needlehost)) {
         repr_break = talloc_asprintf(tmp_ctx, "%s\n", repr);
     } else {
         repr_break = talloc_asprintf(tmp_ctx, "%s %s\n", keyhost, repr);
diff --git a/src/util/sss_ssh.h b/src/util/sss_ssh.h
index 89fa7a1233f..2f88c153cbc 100644
--- a/src/util/sss_ssh.h
+++ b/src/util/sss_ssh.h
@@ -52,6 +52,7 @@ sss_ssh_format_pubkey(TALLOC_CTX *mem_ctx,
 
 errno_t
 sss_ssh_print_pubkey(struct sss_ssh_pubkey *pubkey,
-                     const char *keyhost);
+                     const char *keyhost,
+                     const char *needlehost);
 
 #endif /* _SSS_SSH_H_ */

From 0330ebeba812d9be227d7505e13dc86fd710665c Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 23 Sep 2024 17:27:01 +0200
Subject: [PATCH 016/129] CLIENT:PAM: replace deprecated `_pam_overwrite`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

with `sss_erase_mem_securely()`

Resolves: https://github.com/SSSD/sssd/issues/7606

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 Makefile.am                     |  7 ++++++
 src/sss_client/pam_sss.c        | 38 +++++++++++++++--------------
 src/sss_client/sss_pam_macros.h | 29 -----------------------
 src/util/memory.c               | 27 ---------------------
 src/util/memory_erase.c         | 42 +++++++++++++++++++++++++++++++++
 src/util/memory_erase.h         | 25 ++++++++++++++++++++
 src/util/util.h                 |  2 +-
 7 files changed, 95 insertions(+), 75 deletions(-)
 create mode 100644 src/util/memory_erase.c
 create mode 100644 src/util/memory_erase.h

diff --git a/Makefile.am b/Makefile.am
index 627593f2aa5..2c3ff5f0da0 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -703,6 +703,7 @@ dist_noinst_HEADERS = \
     src/util/cert.h \
     src/util/dlinklist.h \
     src/util/debug.h \
+    src/util/memory_erase.h \
     src/util/util.h \
     src/util/util_errors.h \
     src/util/safe-format-string.h \
@@ -985,6 +986,7 @@ SSS_CRYPT_SOURCES = src/util/crypto/libcrypto/crypto_base64.c \
                     src/util/crypto/libcrypto/crypto_prng.c \
                     src/util/atomic_io.c \
                     src/util/memory.c \
+                    src/util/memory_erase.c \
                     $(NULL)
 SSS_CRYPT_CFLAGS = $(CRYPTO_CFLAGS)
 SSS_CRYPT_LIBS = $(CRYPTO_LIBS)
@@ -1264,6 +1266,7 @@ libsss_util_la_SOURCES = \
     src/util/util_ext.c \
     src/util/util_preauth.c \
     src/util/memory.c \
+    src/util/memory_erase.c \
     src/util/safe-format-string.c \
     src/util/server.c \
     src/util/signal.c \
@@ -4168,6 +4171,7 @@ pam_sss_la_SOURCES = \
     src/sss_client/sss_cli.h \
     src/util/atomic_io.c \
     src/util/authtok-utils.c \
+    src/util/memory_erase.c \
     src/sss_client/sss_pam_macros.h \
     src/sss_client/sss_pam_compat.h
 
@@ -4692,6 +4696,7 @@ krb5_child_SOURCES = \
     src/util/find_uid.c \
     src/util/atomic_io.c \
     src/util/memory.c \
+    src/util/memory_erase.c \
     src/util/authtok.c \
     src/util/authtok-utils.c \
     src/util/util.c \
@@ -4736,6 +4741,7 @@ ldap_child_SOURCES = \
     src/util/sss_iobuf.c \
     src/util/atomic_io.c \
     src/util/memory.c \
+    src/util/memory_erase.c \
     src/util/authtok.c \
     src/util/authtok-utils.c \
     src/util/util.c \
@@ -4885,6 +4891,7 @@ oidc_child_SOURCES = \
     src/oidc_child/oidc_child_json.c \
     src/util/atomic_io.c \
     src/util/memory.c \
+    src/util/memory_erase.c \
     src/util/strtonum.c \
     $(NULL)
 oidc_child_CFLAGS = \
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index d1101e16c69..edac3591f3c 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -49,6 +49,7 @@
 #include "util/atomic_io.h"
 #include "util/authtok-utils.h"
 #include "util/dlinklist.h"
+#include "util/memory_erase.h"
 
 #include <libintl.h>
 #define _(STRING) dgettext (PACKAGE, STRING)
@@ -171,19 +172,19 @@ static void free_cert_list(struct cert_auth_info *list)
 static void overwrite_and_free_authtoks(struct pam_items *pi)
 {
     if (pi->pam_authtok != NULL) {
-        _pam_overwrite_n((void *)pi->pam_authtok, pi->pam_authtok_size);
+        sss_erase_mem_securely((void *)pi->pam_authtok, pi->pam_authtok_size);
         free((void *)pi->pam_authtok);
         pi->pam_authtok = NULL;
     }
 
     if (pi->pam_newauthtok != NULL) {
-        _pam_overwrite_n((void *)pi->pam_newauthtok,  pi->pam_newauthtok_size);
+        sss_erase_mem_securely((void *)pi->pam_newauthtok,  pi->pam_newauthtok_size);
         free((void *)pi->pam_newauthtok);
         pi->pam_newauthtok = NULL;
     }
 
     if (pi->first_factor != NULL) {
-        _pam_overwrite_n((void *)pi->first_factor, strlen(pi->first_factor));
+        sss_erase_mem_securely((void *)pi->first_factor, strlen(pi->first_factor));
         free((void *)pi->first_factor);
         pi->first_factor = NULL;
     }
@@ -304,10 +305,10 @@ static int do_pam_conversation(pam_handle_t *pamh, const int msg_style,
             if (state == SSS_PAM_CONV_REENTER) {
                 if (null_strcmp(answer, resp[0].resp) != 0) {
                     logger(pamh, LOG_NOTICE, "Passwords do not match.");
-                    _pam_overwrite((void *)resp[0].resp);
+                    sss_erase_mem_securely((void *)resp[0].resp, strlen(resp[0].resp));
                     free(resp[0].resp);
                     if (answer != NULL) {
-                        _pam_overwrite((void *) answer);
+                        sss_erase_mem_securely((void *) answer, strlen(answer));
                         free(answer);
                         answer = NULL;
                     }
@@ -322,7 +323,7 @@ static int do_pam_conversation(pam_handle_t *pamh, const int msg_style,
                     ret = PAM_CRED_ERR;
                     goto failed;
                 }
-                _pam_overwrite((void *)resp[0].resp);
+                sss_erase_mem_securely((void *)resp[0].resp, strlen(resp[0].resp));
                 free(resp[0].resp);
             } else {
                 if (resp[0].resp == NULL) {
@@ -330,7 +331,7 @@ static int do_pam_conversation(pam_handle_t *pamh, const int msg_style,
                     answer = NULL;
                 } else {
                     answer = strndup(resp[0].resp, MAX_AUTHTOK_SIZE);
-                    _pam_overwrite((void *)resp[0].resp);
+                    sss_erase_mem_securely((void *)resp[0].resp, strlen(resp[0].resp));
                     free(resp[0].resp);
                     if(answer == NULL) {
                         D(("strndup failed"));
@@ -1616,7 +1617,7 @@ static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
 
 done:
     if (buf != NULL ) {
-        _pam_overwrite_n((void *)buf, rd.len);
+        sss_erase_mem_securely((void *)buf, rd.len);
         free(buf);
     }
     free(repbuf);
@@ -1642,7 +1643,7 @@ static int prompt_password(pam_handle_t *pamh, struct pam_items *pi,
         pi->pam_authtok_size=0;
     } else {
         pi->pam_authtok = strdup(answer);
-        _pam_overwrite((void *)answer);
+        sss_erase_mem_securely((void *)answer, strlen(answer));
         free(answer);
         answer=NULL;
         if (pi->pam_authtok == NULL) {
@@ -1781,11 +1782,11 @@ static int prompt_2fa(pam_handle_t *pamh, struct pam_items *pi,
 done:
     if (resp != NULL) {
         if (resp[0].resp != NULL) {
-            _pam_overwrite((void *)resp[0].resp);
+            sss_erase_mem_securely((void *)resp[0].resp, strlen(resp[0].resp));
             free(resp[0].resp);
         }
         if (resp[1].resp != NULL) {
-            _pam_overwrite((void *)resp[1].resp);
+            sss_erase_mem_securely((void *)resp[1].resp, strlen(resp[1].resp));
             free(resp[1].resp);
         }
 
@@ -1814,7 +1815,7 @@ static int prompt_2fa_single(pam_handle_t *pamh, struct pam_items *pi,
         pi->pam_authtok_size=0;
     } else {
         pi->pam_authtok = strdup(answer);
-        _pam_overwrite((void *)answer);
+        sss_erase_mem_securely((void *)answer, strlen(answer));
         free(answer);
         answer=NULL;
         if (pi->pam_authtok == NULL) {
@@ -1995,7 +1996,8 @@ static int prompt_passkey(pam_handle_t *pamh, struct pam_items *pi,
 done:
     if (resp != NULL) {
         if (resp[pin_idx].resp != NULL) {
-            _pam_overwrite((void *)resp[pin_idx].resp);
+            sss_erase_mem_securely((void *)resp[pin_idx].resp,
+                                   strlen(resp[pin_idx].resp));
             free(resp[pin_idx].resp);
         }
 
@@ -2278,7 +2280,7 @@ static int prompt_sc_pin(pam_handle_t *pamh, struct pam_items *pi)
         }
 
         answer = strndup(resp[0].resp, MAX_AUTHTOK_SIZE);
-        _pam_overwrite((void *)resp[0].resp);
+        sss_erase_mem_securely((void *)resp[0].resp, strlen(resp[0].resp));
         free(resp[0].resp);
         resp[0].resp = NULL;
         if (answer == NULL) {
@@ -2368,17 +2370,17 @@ static int prompt_sc_pin(pam_handle_t *pamh, struct pam_items *pi)
     ret = PAM_SUCCESS;
 
 done:
-    _pam_overwrite((void *)answer);
+    sss_erase_mem_securely((void *)answer, strlen(answer));
     free(answer);
     answer=NULL;
 
     if (resp != NULL) {
         if (resp[0].resp != NULL) {
-            _pam_overwrite((void *)resp[0].resp);
+            sss_erase_mem_securely((void *)resp[0].resp, strlen(resp[0].resp));
             free(resp[0].resp);
         }
         if (resp[1].resp != NULL) {
-            _pam_overwrite((void *)resp[1].resp);
+            sss_erase_mem_securely((void *)resp[1].resp, strlen(resp[1].resp));
             free(resp[1].resp);
         }
 
@@ -2408,7 +2410,7 @@ static int prompt_new_password(pam_handle_t *pamh, struct pam_items *pi)
         pi->pam_newauthtok_size=0;
     } else {
         pi->pam_newauthtok = strdup(answer);
-        _pam_overwrite((void *)answer);
+        sss_erase_mem_securely((void *)answer, strlen(answer));
         free(answer);
         answer=NULL;
         if (pi->pam_newauthtok == NULL) {
diff --git a/src/sss_client/sss_pam_macros.h b/src/sss_client/sss_pam_macros.h
index 0a7e266010a..0832cf14a39 100644
--- a/src/sss_client/sss_pam_macros.h
+++ b/src/sss_client/sss_pam_macros.h
@@ -25,35 +25,6 @@
 #ifndef _SSS_PAM_MACROS_H
 #define _SSS_PAM_MACROS_H
 
-/* Older versions of the pam development headers do not include the
- * _pam_overwrite_n(n,x) macro. This implementation is copied from
- * the Fedora 11 _pam_macros.h.
- */
-#ifdef HAVE_SECURITY__PAM_MACROS_H
-# include <security/_pam_macros.h>
-#endif /* HAVE_SECURITY__PAM_MACROS_H */
-
-#ifndef _pam_overwrite
-#define _pam_overwrite(x)        \
-do {                             \
-     register char *__xx__;      \
-     if ((__xx__=(x)))           \
-          while (*__xx__)        \
-               *__xx__++ = '\0'; \
-} while (0)
-#endif /* _pam_overwrite */
-
-#ifndef _pam_overwrite_n
-#define _pam_overwrite_n(x,n)   \
-do {                             \
-     register char *__xx__;      \
-     register unsigned int __i__ = 0;    \
-     if ((__xx__=(x)))           \
-        for (;__i__<n; __i__++) \
-            __xx__[__i__] = 0; \
-} while (0)
-#endif /* _pam_overwrite_n */
-
 #ifndef D
 #define D(x)   do { } while (0)
 #endif /* D */
diff --git a/src/util/memory.c b/src/util/memory.c
index 8b179adde3c..d3a9000311a 100644
--- a/src/util/memory.c
+++ b/src/util/memory.c
@@ -23,24 +23,6 @@
 #include "util/util.h"
 
 
-#ifdef HAVE_EXPLICIT_BZERO
-
-#include <string.h>
-
-#else
-
-typedef void *(*_sss_memset_t)(void *, int, size_t);
-
-static volatile _sss_memset_t memset_func = memset;
-
-static void explicit_bzero(void *s, size_t n)
-{
-    memset_func(s, 0, n);
-}
-
-#endif
-
-
 void sss_erase_krb5_data_securely(krb5_data *data)
 {
     if (data != NULL) {
@@ -72,15 +54,6 @@ int sss_erase_talloc_mem_securely(void *p)
     return 0;
 }
 
-void sss_erase_mem_securely(void *p, size_t size)
-{
-    if ((p == NULL) || (size == 0)) {
-        return;
-    }
-
-    explicit_bzero(p, size);
-}
-
 
 struct mem_holder {
     void *mem;
diff --git a/src/util/memory_erase.c b/src/util/memory_erase.c
new file mode 100644
index 00000000000..d10d9ea042a
--- /dev/null
+++ b/src/util/memory_erase.c
@@ -0,0 +1,42 @@
+/*
+    Copyright (C) 2024 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "config.h"
+#include <string.h>
+
+#ifndef HAVE_EXPLICIT_BZERO
+
+typedef void *(*_sss_memset_t)(void *, int, size_t);
+
+static volatile _sss_memset_t memset_func = memset;
+
+static void explicit_bzero(void *s, size_t n)
+{
+    memset_func(s, 0, n);
+}
+
+#endif
+
+
+void sss_erase_mem_securely(void *p, size_t size)
+{
+    if ((p == NULL) || (size == 0)) {
+        return;
+    }
+
+    explicit_bzero(p, size);
+}
diff --git a/src/util/memory_erase.h b/src/util/memory_erase.h
new file mode 100644
index 00000000000..b75b5ff3e27
--- /dev/null
+++ b/src/util/memory_erase.h
@@ -0,0 +1,25 @@
+/*
+    Copyright (C) 2024 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef __SSSD_MEMORY_ERASE_H__
+#define __SSSD_MEMORY_ERASE_H__
+
+#include <stddef.h>
+
+void sss_erase_mem_securely(void *p, size_t size);
+
+#endif /* __SSSD_MEMORY_ERASE_H__ */
diff --git a/src/util/util.h b/src/util/util.h
index a3d297513bf..406c4178589 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -49,6 +49,7 @@
 #include "util/sss_format.h"
 #include "util/sss_regexp.h"
 #include "util/debug.h"
+#include "util/memory_erase.h"
 
 /* name of the monitor server instance */
 #define SSSD_MONITOR_NAME        "sssd"
@@ -237,7 +238,6 @@ int sss_mem_attach(TALLOC_CTX *mem_ctx, void *ptr, void_destructor_fn_t *fn);
  * to make it possible to use it as talloc destructor.
  */
 int sss_erase_talloc_mem_securely(void *p);
-void sss_erase_mem_securely(void *p, size_t size);
 void sss_erase_krb5_data_securely(krb5_data *data);
 void sss_erase_krb5_creds_securely(krb5_creds *cred);
 

From 312e0ebac1cd17007bf47560b12cdae0fdce4295 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 18 Sep 2024 16:41:04 +0200
Subject: [PATCH 017/129] Revert "ci: allow deprecated functions during build"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit ef014b8b293ca7859dc8c30db4cdcfa343c3c477.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 494784be292..aa27cb00d94 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,14 +29,14 @@ jobs:
       working-directory: x86_64
       run: |
         source ../contrib/fedora/bashrc_sssd
-        make CFLAGS+="$SSS_WARNINGS -Werror -Wno-error=deprecated-declarations"
+        make CFLAGS+="$SSS_WARNINGS -Werror"
 
     - name: make check
       shell: bash
       working-directory: x86_64
       run: |
         source ../contrib/fedora/bashrc_sssd
-        make CFLAGS+="$SSS_WARNINGS -Werror -Wno-error=deprecated-declarations" check
+        make CFLAGS+="$SSS_WARNINGS -Werror" check
 
     - name: make distcheck
       shell: bash

From 10bf7ab415a68bf89dd62f90f8d33bd83df0f750 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 24 Sep 2024 10:43:35 +0200
Subject: [PATCH 018/129] SPEC: use '/run/sssd' as a home dir for 'sssd' user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

even if 'sssd.sysusers' aren't used.
Practically this is only important for C9S, since C10S and
modern Fedora versions do use 'sssd.sysusers'

Also use `usermod` to update home dir in case user already exists.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 contrib/sssd.spec.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 67e8dcba2b5..0f71783f82e 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -1097,11 +1097,12 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 
 %if %{use_sssd_user}
 %pre common
+! getent passwd sssd >/dev/null || usermod sssd -d /run/sssd >/dev/null || true
 %if %{use_sysusers}
 %sysusers_create_compat %{SOURCE1}
 %else
 getent group sssd >/dev/null || groupadd -r sssd
-getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "User for sssd" sssd
+getent passwd sssd >/dev/null || useradd -r -g sssd -d /run/sssd -s /sbin/nologin -c "User for sssd" sssd
 %endif
 %endif
 

From ef2a6185738e3f349182dc1632dbf567bd573305 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Wed, 25 Sep 2024 21:07:31 -0400
Subject: [PATCH 019/129] tests: improving gpo tests to be run against ad and
 samba

Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
---
 src/tests/system/tests/test_gpo.py | 247 +++++++++++++++--------------
 1 file changed, 124 insertions(+), 123 deletions(-)

diff --git a/src/tests/system/tests/test_gpo.py b/src/tests/system/tests/test_gpo.py
index ca68607e2d6..0bc54e329a1 100644
--- a/src/tests/system/tests/test_gpo.py
+++ b/src/tests/system/tests/test_gpo.py
@@ -8,11 +8,12 @@
 The following code will modify both SeInteractiveActiveLogonRight and SeRemoteInteractiveLogonRight.
 
 .. code-block::
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, group, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, group, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [],
         }
+       )
 
 An administrative user or group always needs to be specified, to prevent administrative lock outs, for the tests
 "Domain Admins" group is used.
@@ -34,13 +35,14 @@
 import pytest
 from sssd_test_framework.roles.ad import AD
 from sssd_test_framework.roles.client import Client
-from sssd_test_framework.topology import KnownTopology
+from sssd_test_framework.roles.generic import GenericADProvider
+from sssd_test_framework.topology import KnownTopology, KnownTopologyGroup
 
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["su", "ssh"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__is_set_to_enforcing(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__is_set_to_enforcing(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control is set to enforcing and users are allowed
     :description:
@@ -63,17 +65,17 @@ def test_gpo__is_set_to_enforcing(client: Client, ad: AD, method: str):
         3. User authentications are unsuccessful
     :customerscenario: True
     """
-    ad.user("user").add()
-    user1 = ad.user("user1").add()
-    user2 = ad.user("user2").add()
-    deny_user1 = ad.user("deny_user1").add()
-    deny_user2 = ad.user("deny_user2").add()
-    group = ad.group("group").add().add_members([user2])
-    deny_group = ad.group("deny_group").add().add_members([deny_user2])
-
-    ad.gpo("site policy").add().policy(
+    provider.user("user").add()
+    user1 = provider.user("user1").add()
+    user2 = provider.user("user2").add()
+    deny_user1 = provider.user("deny_user1").add()
+    deny_user2 = provider.user("deny_user2").add()
+    group = provider.group("group").add().add_members([user2])
+    deny_group = provider.group("deny_group").add().add_members([deny_user2])
+
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, group, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, group, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1, deny_group],
         }
     ).link()
@@ -104,8 +106,8 @@ def test_gpo__is_set_to_enforcing(client: Client, ad: AD, method: str):
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["su", "ssh"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__is_set_to_enforcing_with_no_policy(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__is_set_to_enforcing_with_no_policy(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control is set to enforcing with no policy
     :description:
@@ -123,7 +125,7 @@ def test_gpo__is_set_to_enforcing_with_no_policy(client: Client, ad: AD, method:
         2. Access check result is granted
     :customerscenario: True
     """
-    ad.user("user").add()
+    provider.user("user").add()
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.start()
@@ -133,8 +135,8 @@ def test_gpo__is_set_to_enforcing_with_no_policy(client: Client, ad: AD, method:
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["su", "ssh"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__is_set_to_permissive_and_users_are_allowed(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__is_set_to_permissive_and_users_are_allowed(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control is set to permissive
     :description:
@@ -156,11 +158,11 @@ def test_gpo__is_set_to_permissive_and_users_are_allowed(client: Client, ad: AD,
         3. Access check result is granted
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
+    user1 = provider.user("user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [],
         }
     ).link()
@@ -182,8 +184,8 @@ def test_gpo__is_set_to_permissive_and_users_are_allowed(client: Client, ad: AD,
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["su", "ssh"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__is_set_to_permissive_and_users_are_denied(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__is_set_to_permissive_and_users_are_denied(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control is set to permissive
     :description:
@@ -205,11 +207,11 @@ def test_gpo__is_set_to_permissive_and_users_are_denied(client: Client, ad: AD,
         3. Access check result is denied
     :customerscenario: True
     """
-    deny_user1 = ad.user("deny_user1").add()
+    deny_user1 = provider.user("deny_user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
     ).link()
@@ -231,8 +233,8 @@ def test_gpo__is_set_to_permissive_and_users_are_denied(client: Client, ad: AD,
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["su", "ssh"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__is_set_to_disabled_and_all_users_are_allowed(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__is_set_to_disabled_and_all_users_are_allowed(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control is set to disabled and all users are allowed
     :description:
@@ -252,13 +254,13 @@ def test_gpo__is_set_to_disabled_and_all_users_are_allowed(client: Client, ad: A
         2. ad_gpo_access_control is disabled
     :customerscenario: True
     """
-    ad.user("user").add()
-    user1 = ad.user("user1").add()
-    deny_user1 = ad.user("deny_user1").add()
+    provider.user("user").add()
+    user1 = provider.user("user1").add()
+    deny_user1 = provider.user("deny_user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
     ).link()
@@ -286,9 +288,9 @@ def test_gpo__is_set_to_disabled_and_all_users_are_allowed(client: Client, ad: A
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
 @pytest.mark.ticket(bz=1695576)
-def test_gpo__implicit_deny_is_set_to_true(client: Client, ad: AD, method: str):
+def test_gpo__implicit_deny_is_set_to_true(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control is set to enforcing and implicit deny is true
     :description:
@@ -304,7 +306,7 @@ def test_gpo__implicit_deny_is_set_to_true(client: Client, ad: AD, method: str):
         1. 'user' authentication is unsuccessful
     :customerscenario: True
     """
-    ad.user("user").add()
+    provider.user("user").add()
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.domain["ad_gpo_implicit_deny"] = "True"
@@ -317,8 +319,10 @@ def test_gpo__implicit_deny_is_set_to_true(client: Client, ad: AD, method: str):
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__domain_and_sites_inheritance_when_site_is_enforcing(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__domain_and_sites_inheritance_when_site_is_enforcing(
+    client: Client, provider: GenericADProvider, method: str
+):
     """
     :title: Group policy object host base access control checking inheritance for sites enforced and domains
     :description:
@@ -343,29 +347,22 @@ def test_gpo__domain_and_sites_inheritance_when_site_is_enforcing(client: Client
         2. 'user2' authentication is unsuccessful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    user2 = ad.user("user2").add()
+    user1 = provider.user("user1").add()
+    user2 = provider.user("user2").add()
 
-    site_policy = (
-        ad.gpo("site policy")
-        .add()
-        .policy(
-            {
-                "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
-                "SeDenyInteractiveLogonRight": [user2],
-            }
-        )
-        .link()
-    )
+    provider.gpo("site policy").add().policy(
+        {
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
+            "SeDenyInteractiveLogonRight": [user2],
+        }
+    ).link(enforced=True)
 
-    ad.gpo("domain policy").add().policy(
+    provider.gpo("domain policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user2, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user2, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [user1],
         }
-    ).link(target=f"{ad.host.naming_context}")
-
-    site_policy.link("Set", args=["-Enforced Yes"])
+    ).link(target=f"{provider.naming_context}")
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.start()
@@ -381,8 +378,8 @@ def test_gpo__domain_and_sites_inheritance_when_site_is_enforcing(client: Client
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__domain_and_sites_inheritance(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__domain_and_sites_inheritance(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host base access control checking inheritance for sites and domains.
     :description:
@@ -406,22 +403,22 @@ def test_gpo__domain_and_sites_inheritance(client: Client, ad: AD, method: str):
         2. 'user2' authentication is successful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    user2 = ad.user("user2").add()
+    user1 = provider.user("user1").add()
+    user2 = provider.user("user2").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [user2],
         }
     ).link()
 
-    ad.gpo("domain policy").add().policy(
+    provider.gpo("domain policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user2, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user2, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [user1],
         }
-    ).link(target=f"{ad.host.naming_context}")
+    ).link(target=f"{provider.naming_context}")
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.start()
@@ -437,8 +434,8 @@ def test_gpo__domain_and_sites_inheritance(client: Client, ad: AD, method: str):
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__ou_and_domain_inheritance(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__ou_and_domain_inheritance(client: Client, provider: AD, method: str):
     """
     :title: Group policy object host base access control checking inheritance between ous and domains.
     :description:
@@ -464,25 +461,25 @@ def test_gpo__ou_and_domain_inheritance(client: Client, ad: AD, method: str):
         2. 'user2' authentication is successful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    user2 = ad.user("user2").add()
-    ou = ad.ou("test").add().dn
+    user1 = provider.user("user1").add()
+    user2 = provider.user("user2").add()
+    ou = provider.ou("test").add().dn
 
-    ad.gpo("domain policy").add().policy(
+    provider.gpo("domain policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [user2],
         }
-    ).link(target=f"{ad.host.naming_context}")
+    ).link(target=f"{provider.host.naming_context}")
 
-    ad.gpo("ou policy").add().policy(
+    provider.gpo("ou policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user2, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user2, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [user1],
         }
     ).link(target=ou)
 
-    ad.computer(client.host.hostname.split(".")[0]).move(ou)
+    provider.computer(client.host.hostname.split(".")[0]).move(ou)
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.start()
@@ -537,7 +534,7 @@ def test_gpo__sites_inheritance_using_gpo_link_order(client: Client, ad: AD, met
             "SeInteractiveLogonRight": [user2, ad.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [user1],
         }
-    ).link(args=["-Order 1"])
+    ).link(order=1)
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.start()
@@ -550,8 +547,8 @@ def test_gpo__sites_inheritance_using_gpo_link_order(client: Client, ad: AD, met
 
 
 @pytest.mark.importance("critical")
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__map_interactive_disabling_login_su_and_su_l(client: Client, ad: AD):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__map_interactive_disabling_login_su_and_su_l(client: Client, provider: GenericADProvider):
     """
     :title: Group policy object host based access disabling logon, su, su-l GPO evaluation.
     :description:
@@ -577,12 +574,12 @@ def test_gpo__map_interactive_disabling_login_su_and_su_l(client: Client, ad: AD
         4. 'deny_user1' authentication is unsuccessful for ssh
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    deny_user1 = ad.user("deny_user1").add()
+    user1 = provider.user("user1").add()
+    deny_user1 = provider.user("deny_user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
     ).link()
@@ -604,8 +601,8 @@ def test_gpo__map_interactive_disabling_login_su_and_su_l(client: Client, ad: AD
 
 
 @pytest.mark.importance("critical")
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__map_remote_interactive_disabling_sshd(client: Client, ad: AD):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__map_remote_interactive_disabling_sshd(client: Client, provider: GenericADProvider):
     """
     :title: Group policy object host based access disabling ssh and cockpit GPO evaluation.
     :description:
@@ -630,12 +627,12 @@ def test_gpo__map_remote_interactive_disabling_sshd(client: Client, ad: AD):
         4. 'deny_user1' authentication is unsuccessful for ssh
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    deny_user1 = ad.user("deny_user1").add()
+    user1 = provider.user("user1").add()
+    deny_user1 = provider.user("deny_user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
     ).link()
@@ -658,8 +655,8 @@ def test_gpo__map_remote_interactive_disabling_sshd(client: Client, ad: AD):
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
-def test_gpo__works_when_the_server_is_unreachable(client: Client, ad: AD, method: str):
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_gpo__works_when_the_server_is_unreachable(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host based works when the server is unreachable.
     :description: Tests that gpo processing works from the cache when the server is unreachable
@@ -684,12 +681,12 @@ def test_gpo__works_when_the_server_is_unreachable(client: Client, ad: AD, metho
         5. 'deny_user1' authentication is unsuccessful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    deny_user1 = ad.user("deny_user1").add()
+    user1 = provider.user("user1").add()
+    deny_user1 = provider.user("deny_user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
     ).link()
@@ -708,7 +705,7 @@ def test_gpo__works_when_the_server_is_unreachable(client: Client, ad: AD, metho
         "deny_user1", password="Secret123"
     ), "Denied user authenticated successfully!"
 
-    client.firewall.outbound.drop_host(ad)
+    client.firewall.outbound.drop_host(provider)
     client.sssd.bring_offline()
 
     assert client.auth.parametrize(method).password(
@@ -722,9 +719,9 @@ def test_gpo__works_when_the_server_is_unreachable(client: Client, ad: AD, metho
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
 @pytest.mark.ticket(bz=1547234)
-def test_gpo__honors_the_ad_site_parameter(client: Client, ad: AD, method: str):
+def test_gpo__honors_the_ad_site_parameter(client: Client, provider: GenericADProvider, method: str):
     """
     :title: Group policy object host based access control honors the ad_site parameter in the configuration.
     :description:
@@ -750,16 +747,16 @@ def test_gpo__honors_the_ad_site_parameter(client: Client, ad: AD, method: str):
         2. 'deny_user1' authentication is unsuccessful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    deny_user1 = ad.user("deny_user1").add()
-    ad.site("New-Site").add()
+    user1 = provider.user("user1").add()
+    deny_user1 = provider.user("deny_user1").add()
+    provider.site("New-Site").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
-    ).link(target=f"cn=New-Site,cn=sites,cn=configuration,{ad.host.naming_context}")
+    ).link(target=f"cn=New-Site,cn=sites,cn=configuration,{provider.naming_context}")
 
     client.sssd.domain["ad_gpo_access_control"] = "enforcing"
     client.sssd.domain["ad_site"] = "New-Site"
@@ -834,9 +831,11 @@ def test_gpo__only_needs_host_security_filters_and_permissions(client: Client, a
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
 @pytest.mark.ticket(bz=1316164)
-def test_gpo__ignores_invalid_and_unnecessary_keys_and_values(client: Client, ad: AD, method: str):
+def test_gpo__ignores_invalid_and_unnecessary_keys_and_values(
+    client: Client, provider: GenericADProvider, method: str
+):
     """
     :title: Group policy object host based access control ignores invalid and unnecessary keys and values.
     :description:
@@ -858,12 +857,12 @@ def test_gpo__ignores_invalid_and_unnecessary_keys_and_values(client: Client, ad
         2. 'deny_user1' authentication is unsuccessful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
-    deny_user1 = ad.user("deny_user1").add()
+    user1 = provider.user("user1").add()
+    deny_user1 = provider.user("deny_user1").add()
 
-    ad.gpo("policy invalid keys and values").add().policy(
+    provider.gpo("policy invalid keys and values").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         },
         cfg={"Service General Setting": {"BITS": "2", "wuaserv": "2", "MpsSvc": "2"}},
@@ -936,9 +935,11 @@ def test_gpo__skips_unreadable_gpo_policies(client: Client, ad: AD, method: str)
 
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
-@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
 @pytest.mark.ticket(bz=2151450)
-def test_gpo__finds_all_groups_when_auto_private_groups_is_set_true(client: Client, ad: AD, method: str):
+def test_gpo__finds_all_groups_when_auto_private_groups_is_set_true(
+    client: Client, provider: GenericADProvider, method: str
+):
     """
     :title: Primary group is missing from users when auto_private_groups are enabled
     :description:
@@ -957,11 +958,11 @@ def test_gpo__finds_all_groups_when_auto_private_groups_is_set_true(client: Clie
         2. User found and primary group 'Domain Users' is listed
     :customerscenario: True
     """
-    user1 = ad.user("user1").add()
+    user1 = provider.user("user1").add()
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [],
         }
     ).link()
@@ -983,10 +984,10 @@ def test_gpo__finds_all_groups_when_auto_private_groups_is_set_true(client: Clie
 @pytest.mark.importance("critical")
 @pytest.mark.parametrize("method", ["ssh", "su"])
 @pytest.mark.parametrize("auto_private_groups", ["true", "false", "hybrid"])
-@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
 @pytest.mark.ticket(gh=7452)
 def test_gpo__works_when_auto_private_group_is_used_with_posix_accounts(
-    client: Client, ad: AD, method: str, auto_private_groups: str
+    client: Client, provider: GenericADProvider, method: str, auto_private_groups: str
 ):
     """
     :title: GPO evaluation fails when auto_private_groups used with posix accounts
@@ -1005,12 +1006,12 @@ def test_gpo__works_when_auto_private_group_is_used_with_posix_accounts(
         2. Authenticated user is unsuccessful
     :customerscenario: True
     """
-    user1 = ad.user("user1").add(uid=10000, gid=10000)
-    deny_user1 = ad.user("deny_user1").add(uid=10001, gid=10001)
+    user1 = provider.user("user1").add(uid=10000, gid=10000)
+    deny_user1 = provider.user("deny_user1").add(uid=10001, gid=10001)
 
-    ad.gpo("site policy").add().policy(
+    provider.gpo("site policy").add().policy(
         {
-            "SeInteractiveLogonRight": [user1, ad.group("Domain Admins")],
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
             "SeDenyInteractiveLogonRight": [deny_user1],
         }
     ).link()

From 39856247e437a5ce3a65772c1337946b1c00ec8d Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 30 Sep 2024 14:01:18 +0200
Subject: [PATCH 020/129] CLIENT:PAM: avoid NULL deref
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is hardly possible in the wild but should fix Coverity
complain.

Reviewed-by: Alejandro López <allopez@redhat.com>
---
 src/sss_client/pam_sss.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index edac3591f3c..4350b7f7f7e 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -2370,9 +2370,11 @@ static int prompt_sc_pin(pam_handle_t *pamh, struct pam_items *pi)
     ret = PAM_SUCCESS;
 
 done:
-    sss_erase_mem_securely((void *)answer, strlen(answer));
-    free(answer);
-    answer=NULL;
+    if (answer != NULL) {
+        sss_erase_mem_securely((void *)answer, strlen(answer));
+        free(answer);
+        answer=NULL;
+    }
 
     if (resp != NULL) {
         if (resp[0].resp != NULL) {

From 60f282d2c9b336a1293503af3810414d9a83fc18 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 23 Sep 2024 20:53:54 +0200
Subject: [PATCH 021/129] SPEC: keep 'sssd-polkit-rules' on RHEL9
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

this partially reverts a7d0bbeb5a8a41e80fec91d7d38b5dcb35eebe8f

 - RHEL9 will keep default value of service user set to 'root',
   so polkit rules shouldn't be needed by default

 - it's undesirable to remove sub-package within a major release

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 contrib/sssd.spec.in | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 0f71783f82e..bd57f830461 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -210,9 +210,11 @@ License: GPL-3.0-or-later
 Obsoletes: libsss_simpleifp < 2.9.0
 Obsoletes: libsss_simpleifp-debuginfo < 2.9.0
 %endif
+%if 0%{?rhel} != 9
 %if %{use_sssd_user}
 Obsoletes: sssd-polkit-rules < 2.10.0
 %endif
+%endif
 # Requires
 # due to ABI changes in 1.1.30/1.2.0
 Requires: libldb >= %{ldb_version}
@@ -474,6 +476,19 @@ Provides the D-Bus responder of the SSSD, called the InfoPipe, that allows
 the information from the SSSD to be transmitted over the system bus.
 
 %if 0%{?rhel} == 9
+%if %{use_sssd_user}
+%package polkit-rules
+Summary: Rules for polkit integration for SSSD
+Group: Applications/System
+License: GPL-3.0-or-later
+Requires: polkit >= 0.106
+Requires: sssd-common = %{version}-%{release}
+
+%description polkit-rules
+Provides rules for polkit integration with SSSD. This is required
+for smartcard support if SSSD service is running as user 'sssd'.
+%endif
+
 %package -n libsss_simpleifp
 Summary: The SSSD D-Bus responder helper library
 License: GPL-3.0-or-later
@@ -885,6 +900,9 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %{_sysusersdir}/sssd.conf
 %endif
 %if %{use_sssd_user}
+%if 0%{?rhel} == 9
+%files polkit-rules
+%endif
 %{_datadir}/polkit-1/rules.d/*
 %endif
 

From cb9319677e95bfec2396ada31dae4628b0418384 Mon Sep 17 00:00:00 2001
From: xuraoqing <609179072@qq.com>
Date: Wed, 18 Sep 2024 11:51:22 +0800
Subject: [PATCH 022/129] fixed memory leak due to use popt incorrectly

Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/sss_client/autofs/autofs_test_client.c |  6 ++--
 src/tests/test_ssh_client.c                | 41 ++++++++++++++--------
 2 files changed, 31 insertions(+), 16 deletions(-)

diff --git a/src/sss_client/autofs/autofs_test_client.c b/src/sss_client/autofs/autofs_test_client.c
index f5cbf3649e0..b9fd5ebf8f5 100644
--- a/src/sss_client/autofs/autofs_test_client.c
+++ b/src/sss_client/autofs/autofs_test_client.c
@@ -71,13 +71,12 @@ int main(int argc, const char *argv[])
         exit(EXIT_FAILURE);
     }
 
-    poptFreeContext(pc);
-
     requested_protocol = pc_protocol;
     protocol = _sss_auto_protocol_version(requested_protocol);
     if (protocol != requested_protocol) {
         fprintf(stderr, "Unsupported protocol version: %u -> %u\n",
                 requested_protocol, protocol);
+        poptFreeContext(pc);
         exit(EXIT_FAILURE);
     }
 
@@ -85,6 +84,7 @@ int main(int argc, const char *argv[])
     if (ret) {
         fprintf(stderr, "setautomntent failed [%d]: %s\n",
                 ret, strerror(ret));
+        poptFreeContext(pc);
         exit(EXIT_FAILURE);
     }
     printf("setautomntent done for %s\n", mapname);
@@ -141,8 +141,10 @@ int main(int argc, const char *argv[])
     if (ret) {
         fprintf(stderr, "endautomntent failed [%d]: %s\n",
                 ret, strerror(ret));
+        poptFreeContext(pc);
         exit(EXIT_FAILURE);
     }
     printf("endautomntent done for %s\n", mapname);
+    poptFreeContext(pc);
     return 0;
 }
diff --git a/src/tests/test_ssh_client.c b/src/tests/test_ssh_client.c
index 8901ef67da7..be32468fc7d 100644
--- a/src/tests/test_ssh_client.c
+++ b/src/tests/test_ssh_client.c
@@ -43,6 +43,7 @@ int main(int argc, const char *argv[])
     char *av[3];
     char buf[5]; /* Ridiculously small buffer by design */
     ssize_t len;
+    int return_code = 0;
 
     /* Set debug level to invalid value so we can decide if -d 0 was used. */
     debug_level = SSSDBG_INVALID;
@@ -55,18 +56,18 @@ int main(int argc, const char *argv[])
             fprintf(stderr, "\nInvalid option %s: %s\n\n",
                     poptBadOption(pc, 0), poptStrerror(opt));
             poptPrintUsage(pc, stderr, 0);
-            return 3;
+	    return_code = 3;
+            goto end;
         }
     }
 
     pc_user = poptGetArg(pc);
     if (pc_user == NULL) {
         fprintf(stderr, "No user specified\n");
-        return 3;
+        return_code = 3;
+	goto end;
     }
 
-    poptFreeContext(pc);
-
     DEBUG_CLI_INIT(debug_level);
 
     ret = stat(SSH_AK_CLIENT_PATH, &sb);
@@ -75,13 +76,15 @@ int main(int argc, const char *argv[])
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Could not stat %s [%d]: %s\n",
               SSH_AK_CLIENT_PATH, ret, strerror(ret));
-        return 3;
+        return_code = 3;
+	goto end;
     }
 
     ret = pipe(p);
     if (ret != 0) {
         perror("pipe");
-        return 3;
+        return_code = 3;
+	goto end;
     }
 
     switch (pid = fork()) {
@@ -90,7 +93,8 @@ int main(int argc, const char *argv[])
         close(p[0]);
         close(p[1]);
         DEBUG(SSSDBG_CRIT_FAILURE, "fork failed: %d\n", ret);
-        return 3;
+        return_code = 3;
+	goto end;
     case 0:
         /* child */
         av[0] = discard_const(SSH_AK_CLIENT_PATH);
@@ -101,11 +105,13 @@ int main(int argc, const char *argv[])
         ret = dup2(p[1], STDOUT_FILENO);
         if (ret == -1) {
             perror("dup2");
-            return 3;
+            return_code = 3;
+	    goto end;
         }
 
         execv(av[0], av);
-        return 3;
+        return_code = 3;
+	goto end;
     default:
         /* parent */
         break;
@@ -116,23 +122,30 @@ int main(int argc, const char *argv[])
     close(p[0]);
     if (len == -1) {
         perror("waitpid");
-        return 3;
+        return_code = 3;
+	goto end;
     }
 
     pid = waitpid(pid, &status, 0);
     if (pid == -1) {
         perror("waitpid");
-        return 3;
+        return_code = 3;
+	goto end;
     }
 
     if (WIFEXITED(status)) {
         printf("sss_ssh_authorizedkeys exited with return code %d\n", WEXITSTATUS(status));
-        return 0;
+        return_code = 0;
+	goto end;
     } else if (WIFSIGNALED(status)) {
         printf("sss_ssh_authorizedkeys exited with signal %d\n", WTERMSIG(status));
-        return 1;
+        return_code = 1;
+	goto end;
     }
 
     printf("sss_ssh_authorizedkeys exited for another reason\n");
-    return 2;
+    return_code = 2;
+end:
+    poptFreeContext(pc);
+    return return_code;
 }

From 3a644161d5a82c84627002305894051c157879b4 Mon Sep 17 00:00:00 2001
From: Justin Stephenson <jstephen@redhat.com>
Date: Wed, 18 Sep 2024 10:36:58 -0400
Subject: [PATCH 023/129] sdap: Log hint for ignore unreadable references

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/ldap/sdap_async_nested_groups.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/providers/ldap/sdap_async_nested_groups.c b/src/providers/ldap/sdap_async_nested_groups.c
index 2e3b0c434f3..8a97c9db888 100644
--- a/src/providers/ldap/sdap_async_nested_groups.c
+++ b/src/providers/ldap/sdap_async_nested_groups.c
@@ -1633,6 +1633,8 @@ sdap_nested_group_single_step_process(struct tevent_req *subreq)
         } else {
             DEBUG(SSSDBG_OP_FAILURE, "Unknown entry type [%s]!\n",
                   state->current_member->dn);
+            DEBUG(SSSDBG_OP_FAILURE, "Consider enabling sssd-ldap option "
+                                     "ldap_ignore_unreadable_references\n");
             ret = EINVAL;
             goto done;
         }

From b1bee78de84c21642c400780d57a2a9988c30613 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Thu, 5 Sep 2024 09:37:12 -0400
Subject: [PATCH 024/129] tests: removing intg/test_sudo.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These two tests are covered by system/tests/test_sudo.py

Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tests/intg/Makefile.am  |   1 -
 src/tests/intg/test_sudo.py | 295 ------------------------------------
 2 files changed, 296 deletions(-)
 delete mode 100644 src/tests/intg/test_sudo.py

diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index ee76c99eff1..1dc1e3014c2 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -37,7 +37,6 @@ dist_noinst_DATA = \
     test_infopipe.py \
     test_ssh_pubkey.py \
     test_pam_responder.py \
-    test_sudo.py \
     test_resolver.py \
     conftest.py \
     sssd_hosts.py \
diff --git a/src/tests/intg/test_sudo.py b/src/tests/intg/test_sudo.py
deleted file mode 100644
index da87bbf851c..00000000000
--- a/src/tests/intg/test_sudo.py
+++ /dev/null
@@ -1,295 +0,0 @@
-#
-# Sudo integration test
-#
-# Copyright (c) 2018 Red Hat, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import os
-import stat
-import signal
-import subprocess
-import time
-import ldap
-import pytest
-import json
-
-import config
-import ds_openldap
-import ldap_ent
-from util import unindent, get_call_output
-
-LDAP_BASE_DN = "dc=example,dc=com"
-
-
-class SudoReplyElement:
-    def __init__(self, retval, rules):
-        self.retval = retval
-        self.rules = rules
-
-
-class SudoReply:
-    def __init__(self, json_string):
-        self.jres = json.loads(json_string)
-        for reply_elem in self.jres:
-            el = SudoReplyElement(reply_elem['retval'],
-                                  reply_elem['result']['rules'])
-            if reply_elem['type'] == 'default':
-                self.defaults = el
-            if reply_elem['type'] == 'rules':
-                self.sudo_rules = el
-
-
-@pytest.fixture(scope="module")
-def ds_inst(request):
-    """LDAP server instance fixture"""
-    ds_inst = ds_openldap.DSOpenLDAP(
-        config.PREFIX, 10389, LDAP_BASE_DN,
-        "cn=admin", "Secret123"
-    )
-
-    try:
-        ds_inst.setup()
-    except Exception:
-        ds_inst.teardown()
-        raise
-    request.addfinalizer(ds_inst.teardown)
-    return ds_inst
-
-
-@pytest.fixture(scope="module")
-def ldap_conn(request, ds_inst):
-    """LDAP server connection fixture"""
-    ldap_conn = ds_inst.bind()
-    ldap_conn.ds_inst = ds_inst
-    request.addfinalizer(ldap_conn.unbind_s)
-    return ldap_conn
-
-
-def create_ldap_entries(ldap_conn, ent_list=None):
-    """Add LDAP entries from ent_list"""
-    if ent_list is not None:
-        for entry in ent_list:
-            ldap_conn.add_s(entry[0], entry[1])
-
-
-def cleanup_ldap_entries(ldap_conn, ent_list=None):
-    """Remove LDAP entries added by create_ldap_entries"""
-    if ent_list is None:
-        for ou in ("Users", "Groups", "Netgroups", "Services", "Policies"):
-            for entry in ldap_conn.search_s(f"ou={ou},"
-                                            f"{ldap_conn.ds_inst.base_dn}",
-                                            ldap.SCOPE_ONELEVEL,
-                                            attrlist=[]):
-                ldap_conn.delete_s(entry[0])
-    else:
-        for entry in ent_list:
-            ldap_conn.delete_s(entry[0])
-
-
-def create_ldap_cleanup(request, ldap_conn, ent_list=None):
-    """Add teardown for removing all user/group LDAP entries"""
-    request.addfinalizer(lambda: cleanup_ldap_entries(ldap_conn, ent_list))
-
-
-def create_ldap_fixture(request, ldap_conn, ent_list=None):
-    """Add LDAP entries and add teardown for removing them"""
-    create_ldap_entries(ldap_conn, ent_list)
-    create_ldap_cleanup(request, ldap_conn, ent_list)
-
-
-SCHEMA_RFC2307_BIS = "rfc2307bis"
-
-
-def format_basic_conf(ldap_conn, schema):
-    """Format a basic SSSD configuration"""
-    schema_conf = "ldap_schema         = " + schema + "\n"
-    schema_conf += "ldap_group_object_class = groupOfNames\n"
-    return unindent("""\
-        [sssd]
-        domains             = LDAP
-        services            = nss, sudo
-
-        [nss]
-
-        [sudo]
-        debug_level=10
-
-        [domain/LDAP]
-        {schema_conf}
-        id_provider         = ldap
-        auth_provider       = ldap
-        ldap_uri            = {ldap_conn.ds_inst.ldap_url}
-        ldap_search_base    = {ldap_conn.ds_inst.base_dn}
-        ldap_sudo_use_host_filter = false
-        ldap_sudo_random_offset = 0
-        ldap_id_use_start_tls = false
-        debug_level=10
-    """).format(**locals())
-
-
-def create_conf_file(contents):
-    """Create sssd.conf with specified contents"""
-    conf = open(config.CONF_PATH, "w")
-    conf.write(contents)
-    conf.close()
-    os.chmod(config.CONF_PATH, stat.S_IRUSR | stat.S_IWUSR)
-
-
-def cleanup_conf_file():
-    """Remove sssd.conf, if it exists"""
-    if os.path.lexists(config.CONF_PATH):
-        os.unlink(config.CONF_PATH)
-
-
-def create_conf_cleanup(request):
-    """Add teardown for removing sssd.conf"""
-    request.addfinalizer(cleanup_conf_file)
-
-
-def create_conf_fixture(request, contents):
-    """
-    Create sssd.conf with specified contents and add teardown for removing it
-    """
-    create_conf_file(contents)
-    create_conf_cleanup(request)
-
-
-def create_sssd_process():
-    """Start the SSSD process"""
-    my_env = os.environ.copy()
-    my_env['SSSD_INTG_PEER_UID'] = "0"
-    my_env['SSSD_INTG_PEER_GID'] = "0"
-    if subprocess.call(["sssd", "-D", "--logger=files"], env=my_env) != 0:
-        raise Exception("sssd start failed")
-
-
-def get_sssd_pid():
-    pid_file = open(config.PIDFILE_PATH, "r")
-    pid = int(pid_file.read())
-    return pid
-
-
-def cleanup_sssd_process():
-    """Stop the SSSD process and remove its state"""
-    try:
-        pid = get_sssd_pid()
-        os.kill(pid, signal.SIGTERM)
-        while True:
-            try:
-                os.kill(pid, signal.SIGCONT)
-            except OSError:
-                break
-            time.sleep(1)
-    except OSError:
-        pass
-    for path in os.listdir(config.DB_PATH):
-        os.unlink(config.DB_PATH + "/" + path)
-    for path in os.listdir(config.MCACHE_PATH):
-        os.unlink(config.MCACHE_PATH + "/" + path)
-
-
-def create_sssd_fixture(request):
-    """Start SSSD and add teardown for stopping it and removing its state"""
-    create_sssd_process()
-    create_sssd_cleanup(request)
-
-
-def create_sssd_cleanup(request):
-    """Add teardown for stopping SSSD and removing its state"""
-    request.addfinalizer(cleanup_sssd_process)
-
-
-@pytest.fixture()
-def sudocli_tool(request):
-    sudocli_path = os.path.join(config.ABS_BUILDDIR,
-                                "..", "..", "..", "sss_sudo_cli")
-    assert os.access(sudocli_path, os.X_OK)
-    return sudocli_path
-
-
-@pytest.fixture
-def add_common_rules(request, ldap_conn):
-    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
-    ent_list.add_user("user1", 1001, 2001)
-    ent_list.add_user("user2", 1001, 2001)
-    ent_list.add_sudo_rule("user1_allow_less_shadow",
-                           users=("user1",),
-                           hosts=("ALL",),
-                           commands=("/usr/bin/less /etc/shadow", "/bin/ls"))
-    create_ldap_fixture(request, ldap_conn, ent_list)
-    conf = format_basic_conf(ldap_conn, SCHEMA_RFC2307_BIS)
-    create_conf_fixture(request, conf)
-    create_sssd_fixture(request)
-    return None
-
-
-@pytest.mark.converted('test_sudo.py', 'test_sudo__user_allowed')
-def test_sudo_rule_for_user(add_common_rules, sudocli_tool):
-    """
-    Test that user1 is allowed in the rule but user2 is not
-    """
-    my_env = os.environ.copy()
-    my_env['SSSD_INTG_PEER_UID'] = "0"
-    my_env['SSSD_INTG_PEER_GID'] = "0"
-    user1_rules = get_call_output([sudocli_tool, "user1"], custom_env=my_env)
-    print(user1_rules)
-    reply = SudoReply(user1_rules)
-    assert len(reply.sudo_rules.rules) == 1
-    assert reply.sudo_rules.rules[0]['cn'] == 'user1_allow_less_shadow'
-
-    user2_rules = get_call_output([sudocli_tool, "user2"], custom_env=my_env)
-    reply = SudoReply(user2_rules)
-    assert len(reply.sudo_rules.rules) == 0
-
-
-@pytest.fixture
-def add_double_qualified_rules(request, ldap_conn):
-    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
-    ent_list.add_user("user1", 1001, 2001)
-    ent_list.add_user("user2", 1002, 2001)
-    ent_list.add_user("user3", 1003, 2001)
-    ent_list.add_user("user4", 1004, 2001)
-    ent_list.add_sudo_rule("user1_allow_less_shadow",
-                           users=("user1", "user2", "user2@LDAP", "user3"),
-                           hosts=("ALL",),
-                           commands=("/usr/bin/less /etc/shadow", "/bin/ls"))
-    create_ldap_fixture(request, ldap_conn, ent_list)
-    conf = format_basic_conf(ldap_conn, SCHEMA_RFC2307_BIS)
-    create_conf_fixture(request, conf)
-    create_sssd_fixture(request)
-    return None
-
-
-@pytest.mark.converted('test_sudo.py', 'test_sudo__duplicate_sudo_user')
-def test_sudo_rule_duplicate_sudo_user(add_double_qualified_rules,
-                                       sudocli_tool):
-    """
-    Test that despite user1 and user1@LDAP meaning the same user,
-    the rule is still usable
-    """
-    my_env = os.environ.copy()
-    my_env['SSSD_INTG_PEER_UID'] = "0"
-    my_env['SSSD_INTG_PEER_GID'] = "0"
-    # Try several users to make sure we don't mangle the list
-    for u in ["user1", "user2", "user3"]:
-        user_rules = get_call_output([sudocli_tool, u], custom_env=my_env)
-        reply = SudoReply(user_rules)
-        assert len(reply.sudo_rules.rules) == 1
-        assert reply.sudo_rules.rules[0]['cn'] == 'user1_allow_less_shadow'
-
-    user4_rules = get_call_output([sudocli_tool, "user4"], custom_env=my_env)
-    reply = SudoReply(user4_rules)
-    assert len(reply.sudo_rules.rules) == 0

From 4295e0032997af6f640d74d38a8e0842f9f9d42e Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Thu, 5 Sep 2024 09:35:39 -0400
Subject: [PATCH 025/129] tests: removing intg/test_kcm.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These tests are covered by system/test_kcm.py

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Anuj Borah <aborah@redhat.com>
---
 src/tests/intg/Makefile.am |   1 -
 src/tests/intg/test_kcm.py | 561 -------------------------------------
 2 files changed, 562 deletions(-)
 delete mode 100644 src/tests/intg/test_kcm.py

diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 1dc1e3014c2..802cbe18b9c 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -26,7 +26,6 @@ dist_noinst_DATA = \
     test_files_provider.py \
     kdc.py \
     krb5utils.py \
-    test_kcm.py \
     test_pac_responder.py \
     data/ad_data.ldif \
     data/ad_schema.ldif \
diff --git a/src/tests/intg/test_kcm.py b/src/tests/intg/test_kcm.py
deleted file mode 100644
index 1966ed3d82d..00000000000
--- a/src/tests/intg/test_kcm.py
+++ /dev/null
@@ -1,561 +0,0 @@
-#
-# KCM responder integration tests
-#
-# Copyright (c) 2016 Red Hat, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-import os
-import os.path
-import stat
-import subprocess
-import pytest
-import socket
-import time
-import signal
-import sys
-from datetime import datetime
-
-import kdc
-import krb5utils
-import config
-from util import unindent
-
-MAX_SECRETS = 10
-
-
-class KcmTestEnv(object):
-    def __init__(self, k5kdc, k5util):
-        self.k5kdc = k5kdc
-        self.k5util = k5util
-        self.counter = 0
-
-    def my_uid(self):
-        s_myuid = os.environ['NON_WRAPPED_UID']
-        return int(s_myuid)
-
-    def ccname(self, my_uid=None):
-        if my_uid is None:
-            my_uid = self.my_uid()
-
-        return "KCM:%d" % my_uid
-
-
-def have_kcm_renewal():
-    return os.environ['KCM_RENEW'] == "enabled"
-
-
-@pytest.fixture(scope="module")
-def kdc_instance(request):
-    """Kerberos server instance fixture"""
-    kdc_instance = kdc.KDC(config.PREFIX, "KCMTEST")
-    try:
-        kdc_instance.set_up()
-        kdc_instance.start_kdc()
-    except Exception:
-        kdc_instance.teardown()
-        raise
-    request.addfinalizer(kdc_instance.teardown)
-    return kdc_instance
-
-
-def create_conf_fixture(request, contents):
-    """Generate sssd.conf and add teardown for removing it"""
-    with open(config.CONF_PATH, "w") as conf:
-        conf.write(contents)
-    os.chmod(config.CONF_PATH, stat.S_IRUSR | stat.S_IWUSR)
-    request.addfinalizer(lambda: os.unlink(config.CONF_PATH))
-
-
-def create_sssd_kcm_fixture(sock_path, krb5_conf_path, request):
-    resp_path = os.path.join(config.LIBEXEC_PATH, "sssd", "sssd_kcm")
-    if not os.access(resp_path, os.X_OK):
-        # It would be cleaner to use pytest.mark.skipif on the package level
-        # but upstream insists on supporting RHEL-6..
-        pytest.skip("No KCM responder, skipping")
-
-    kcm_pid = os.fork()
-    assert kcm_pid >= 0
-
-    if kcm_pid == 0:
-        my_env = os.environ.copy()
-        my_env["KRB5_CONFIG"] = krb5_conf_path
-        if subprocess.call([resp_path], env=my_env) != 0:
-            print("sssd_kcm failed to start")
-            sys.exit(99)
-    else:
-        abs_sock_path = os.path.join(config.RUNSTATEDIR, sock_path)
-        sck = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        for _ in range(1, 100):
-            try:
-                sck.connect(abs_sock_path)
-            except Exception:
-                time.sleep(0.1)
-            else:
-                break
-        sck.close()
-        assert os.path.exists(abs_sock_path)
-
-    def kcm_teardown():
-        if kcm_pid == 0:
-            return
-        os.kill(kcm_pid, signal.SIGTERM)
-        try:
-            os.unlink(os.path.join(config.SECDB_PATH, "secrets.ldb"))
-        except OSError as osex:
-            if osex.errno != 2:
-                raise osex
-        try:
-            os.unlink(abs_sock_path)
-        except OSError as osex:
-            if osex.errno != 2:
-                raise osex
-
-    request.addfinalizer(kcm_teardown)
-    return kcm_pid
-
-
-def create_sssd_conf(kcm_path, ccache_storage, max_secrets=MAX_SECRETS):
-    return unindent("""\
-        [sssd]
-        domains = files
-        services = nss
-
-        [domain/files]
-        id_provider = proxy
-        proxy_lib_name = files
-
-        [kcm]
-        socket_path = {kcm_path}
-        ccache_storage = {ccache_storage}
-    """).format(**locals())
-
-
-def create_sssd_conf_renewals(kcm_path, ccache_storage, renew_lifetime,
-                              lifetime, renew_interval,
-                              max_secrets=MAX_SECRETS):
-    return unindent("""\
-        [sssd]
-        domains = files
-        services = nss
-
-        [domain/files]
-        id_provider = proxy
-        proxy_lib_name = files
-
-        [kcm]
-        socket_path = {kcm_path}
-        ccache_storage = {ccache_storage}
-        tgt_renewal = true
-        krb5_renewable_lifetime = {renew_lifetime}
-        krb5_lifetime = {lifetime}
-        krb5_renew_interval = {renew_interval}
-    """).format(**locals())
-
-
-def common_setup_for_kcm_mem(request, kdc_instance, kcm_path, sssd_conf):
-    kcm_socket_include = unindent("""
-    [libdefaults]
-    default_ccache_name = KCM:
-    kcm_socket = {kcm_path}
-    """).format(**locals())
-    kdc_instance.add_config({'kcm_socket': kcm_socket_include})
-
-    create_conf_fixture(request, sssd_conf)
-    create_sssd_kcm_fixture(kcm_path, kdc_instance.krb5_conf_path, request)
-
-    k5util = krb5utils.Krb5Utils(kdc_instance.krb5_conf_path)
-
-    return KcmTestEnv(kdc_instance, k5util)
-
-
-@pytest.fixture
-def setup_for_kcm_mem(request, kdc_instance):
-    """
-    Just set up the files provider for tests and enable the KCM
-    responder
-    """
-    kcm_path = os.path.join(config.RUNSTATEDIR, "kcm.socket")
-    sssd_conf = create_sssd_conf(kcm_path, "memory")
-    return common_setup_for_kcm_mem(request, kdc_instance, kcm_path, sssd_conf)
-
-
-@pytest.fixture
-def setup_for_kcm_secdb(request, kdc_instance):
-    """
-    Set up the KCM responder backed by libsss_secrets
-    """
-    kcm_path = os.path.join(config.RUNSTATEDIR, "kcm.socket")
-    sssd_conf = create_sssd_conf(kcm_path, "secdb")
-    return common_setup_for_kcm_mem(request, kdc_instance, kcm_path, sssd_conf)
-
-
-@pytest.fixture
-def setup_for_kcm_renewals_secdb(passwd_ops_setup, request, kdc_instance):
-    """
-    Set up the KCM renewals backed by libsss_secrets
-    """
-    kcm_path = os.path.join(config.RUNSTATEDIR, "kcm.socket")
-    sssd_conf = create_sssd_conf_renewals(kcm_path, "secdb",
-                                          "10d", "60s", "10s")
-
-    testenv = common_setup_for_kcm_mem(request, kdc_instance, kcm_path, sssd_conf)
-
-    user = dict(name='user1', passwd='x',
-                uid=testenv.my_uid(), gid=testenv.my_uid(),
-                gecos='User for tests',
-                dir='/home/user1',
-                shell='/bin/bash')
-
-    passwd_ops_setup.useradd(**user)
-
-    return testenv
-
-
-def kcm_init_list_destroy(testenv):
-    """
-    Test that kinit, kdestroy and klist work with KCM
-    """
-    testenv.k5kdc.add_principal("kcmtest", "Secret123")
-
-    ok = testenv.k5util.has_principal("kcmtest@KCMTEST")
-    assert ok is False
-    nprincs = testenv.k5util.num_princs()
-    assert nprincs == 0
-
-    out, _, _ = testenv.k5util.kinit("kcmtest", "Secret123")
-    assert out == 0
-    nprincs = testenv.k5util.num_princs()
-    assert nprincs == 1
-
-    exp_ccname = testenv.ccname()
-    ok = testenv.k5util.has_principal("kcmtest@KCMTEST", exp_ccname)
-    assert ok is True
-
-    out = testenv.k5util.kdestroy()
-    assert out == 0
-
-    ok = testenv.k5util.has_principal("kcmtest@KCMTEST")
-    assert ok is False
-    nprincs = testenv.k5util.num_princs()
-    assert nprincs == 0
-
-
-def test_kcm_mem_init_list_destroy(setup_for_kcm_mem):
-    testenv = setup_for_kcm_mem
-    kcm_init_list_destroy(testenv)
-
-
-def test_kcm_secdb_init_list_destroy(setup_for_kcm_secdb):
-    testenv = setup_for_kcm_secdb
-    kcm_init_list_destroy(testenv)
-
-
-def kcm_overwrite(testenv):
-    """
-    Test that reusing a ccache reinitializes the cache and doesn't
-    add the same principal twice
-    """
-    testenv.k5kdc.add_principal("kcmtest", "Secret123")
-    exp_ccache = {'kcmtest@KCMTEST': ['krbtgt/KCMTEST@KCMTEST']}
-
-    assert testenv.k5util.num_princs() == 0
-
-    out, _, _ = testenv.k5util.kinit("kcmtest", "Secret123")
-    assert out == 0
-    assert exp_ccache == testenv.k5util.list_all_princs()
-
-    out, _, _ = testenv.k5util.kinit("kcmtest", "Secret123")
-    assert out == 0
-    assert exp_ccache == testenv.k5util.list_all_princs()
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kinit_overwrite')
-def test_kcm_mem_overwrite(setup_for_kcm_mem):
-    testenv = setup_for_kcm_mem
-    kcm_overwrite(testenv)
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kinit_overwrite')
-def test_kcm_secdb_overwrite(setup_for_kcm_secdb):
-    testenv = setup_for_kcm_secdb
-    kcm_overwrite(testenv)
-
-
-def collection_init_list_destroy(testenv):
-    """
-    Test that multiple principals and service tickets can be stored
-    in a collection.
-    """
-    testenv.k5kdc.add_principal("alice", "alicepw")
-    testenv.k5kdc.add_principal("bob", "bobpw")
-    testenv.k5kdc.add_principal("carol", "carolpw")
-    testenv.k5kdc.add_principal("host/somehostname")
-
-    assert testenv.k5util.num_princs() == 0
-
-    out, _, _ = testenv.k5util.kinit("alice", "alicepw")
-    assert out == 0
-    assert testenv.k5util.default_principal() == 'alice@KCMTEST'
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 1
-    assert cc_coll['alice@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert 'bob@KCMTEST' not in cc_coll
-    assert 'carol@KCMTEST' not in cc_coll
-
-    out, _, _ = testenv.k5util.kinit("bob", "bobpw")
-    assert out == 0
-    assert testenv.k5util.default_principal() == 'bob@KCMTEST'
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 2
-    assert cc_coll['alice@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['bob@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert 'carol@KCMTEST' not in cc_coll
-
-    out, _, _ = testenv.k5util.kinit("carol", "carolpw")
-    assert out == 0
-    assert testenv.k5util.default_principal() == 'carol@KCMTEST'
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 3
-    assert cc_coll['alice@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['bob@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['carol@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-
-    out, _, _ = testenv.k5util.kvno('host/somehostname')
-    assert out == 0
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 3
-    assert set(cc_coll['carol@KCMTEST']) == set(['krbtgt/KCMTEST@KCMTEST',
-                                                 'host/somehostname@KCMTEST'])
-
-    out = testenv.k5util.kdestroy()
-    assert out == 0
-    # If the default is removed, KCM just uses whetever is the first entry
-    # in the collection as the default. And sine the KCM back ends don't
-    # guarantee if they are FIFO or LIFO, just check for either alice or bob
-    assert testenv.k5util.default_principal() in \
-        ['alice@KCMTEST', 'bob@KCMTEST']
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 2
-    assert cc_coll['alice@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['bob@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert 'carol@KCMTEST' not in cc_coll
-
-    # Let's kinit a 3rd principal
-    out, _, _ = testenv.k5util.kinit("carol", "carolpw")
-    assert out == 0
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 3
-    assert cc_coll['alice@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['bob@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['carol@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-
-    # Let's ensure `kdestroy -A` works with more than 2 principals
-    # https://github.com/SSSD/sssd/issues/4440
-    out = testenv.k5util.kdestroy(all_ccaches=True)
-    assert out == 0
-    assert testenv.k5util.num_princs() == 0
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kinit_collection')
-def test_kcm_mem_collection_init_list_destroy(setup_for_kcm_mem):
-    testenv = setup_for_kcm_mem
-    collection_init_list_destroy(testenv)
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kinit_collection')
-def test_kcm_secdb_collection_init_list_destroy(setup_for_kcm_secdb):
-    testenv = setup_for_kcm_secdb
-    collection_init_list_destroy(testenv)
-
-
-def exercise_kswitch(testenv):
-    """
-    Test switching between principals
-    """
-    testenv.k5kdc.add_principal("alice", "alicepw")
-    testenv.k5kdc.add_principal("bob", "bobpw")
-    testenv.k5kdc.add_principal("host/somehostname")
-    testenv.k5kdc.add_principal("host/differenthostname")
-
-    out, _, _ = testenv.k5util.kinit("alice", "alicepw")
-    assert out == 0
-    assert testenv.k5util.default_principal() == 'alice@KCMTEST'
-
-    out, _, _ = testenv.k5util.kinit("bob", "bobpw")
-    assert out == 0
-    assert testenv.k5util.default_principal() == 'bob@KCMTEST'
-
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 2
-    assert cc_coll['alice@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-    assert cc_coll['bob@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-
-    out = testenv.k5util.kswitch("alice@KCMTEST")
-    assert testenv.k5util.default_principal() == 'alice@KCMTEST'
-    out, _, _ = testenv.k5util.kvno('host/somehostname')
-    assert out == 0
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 2
-    assert set(cc_coll['alice@KCMTEST']) == set(['krbtgt/KCMTEST@KCMTEST',
-                                                 'host/somehostname@KCMTEST'])
-    assert cc_coll['bob@KCMTEST'] == ['krbtgt/KCMTEST@KCMTEST']
-
-    out = testenv.k5util.kswitch("bob@KCMTEST")
-    assert testenv.k5util.default_principal() == 'bob@KCMTEST'
-    out, _, _ = testenv.k5util.kvno('host/differenthostname')
-    assert out == 0
-    cc_coll = testenv.k5util.list_all_princs()
-    assert len(cc_coll) == 2
-    assert set(cc_coll['alice@KCMTEST']) == set(['krbtgt/KCMTEST@KCMTEST',
-                                                 'host/somehostname@KCMTEST'])
-    assert set(cc_coll['bob@KCMTEST']) == set(['krbtgt/KCMTEST@KCMTEST',
-                                               'host/differenthostname@KCMTEST'])
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kinit_switch')
-def test_kcm_mem_kswitch(setup_for_kcm_mem):
-    testenv = setup_for_kcm_mem
-    exercise_kswitch(testenv)
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kinit_switch')
-def test_kcm_secdb_kswitch(setup_for_kcm_secdb):
-    testenv = setup_for_kcm_secdb
-    exercise_kswitch(testenv)
-
-
-def exercise_subsidiaries(testenv):
-    """
-    Test that subsidiary caches are usable and KCM: without specifying UID
-    can be used to identify the collection
-    """
-    testenv.k5kdc.add_principal("alice", "alicepw")
-    testenv.k5kdc.add_principal("bob", "bobpw")
-    testenv.k5kdc.add_principal("host/somehostname")
-    testenv.k5kdc.add_principal("host/differenthostname")
-
-    out, _, _ = testenv.k5util.kinit("alice", "alicepw")
-    assert out == 0
-    out, _, _ = testenv.k5util.kvno('host/somehostname')
-
-    out, _, _ = testenv.k5util.kinit("bob", "bobpw")
-    assert out == 0
-    out, _, _ = testenv.k5util.kvno('host/differenthostname')
-
-    exp_cc_coll = dict()
-    exp_cc_coll['alice@KCMTEST'] = 'host/somehostname@KCMTEST'
-    exp_cc_coll['bob@KCMTEST'] = 'host/differenthostname@KCMTEST'
-
-    klist_l = testenv.k5util.list_princs()
-    princ_ccache = dict()
-    for line in klist_l:
-        princ, subsidiary = line.split()
-        princ_ccache[princ] = subsidiary
-
-    for princ, subsidiary in princ_ccache.items():
-        env = {'KRB5CCNAME': subsidiary}
-        cc_coll = testenv.k5util.list_all_princs(env=env)
-        assert len(cc_coll) == 1
-        assert princ in cc_coll
-        assert exp_cc_coll[princ] in cc_coll[princ]
-
-    cc_coll = testenv.k5util.list_all_princs(env={'KRB5CCNAME': 'KCM:'})
-    assert len(cc_coll) == 2
-    assert set(cc_coll['alice@KCMTEST']) == set(['krbtgt/KCMTEST@KCMTEST',
-                                                 'host/somehostname@KCMTEST'])
-    assert set(cc_coll['bob@KCMTEST']) == set(['krbtgt/KCMTEST@KCMTEST',
-                                               'host/differenthostname@KCMTEST'])
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__subsidiaries')
-def test_kcm_mem_subsidiaries(setup_for_kcm_mem):
-    testenv = setup_for_kcm_mem
-    exercise_subsidiaries(testenv)
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__subsidiaries')
-def test_kcm_secdb_subsidiaries(setup_for_kcm_secdb):
-    testenv = setup_for_kcm_secdb
-    exercise_subsidiaries(testenv)
-
-
-def kdestroy_nocache(testenv):
-    """
-    Destroying a non-existing ccache should not throw an error
-    """
-    testenv.k5kdc.add_principal("alice", "alicepw")
-    out, _, _ = testenv.k5util.kinit("alice", "alicepw")
-    assert out == 0
-
-    testenv.k5util.kdestroy()
-    assert out == 0
-    out = testenv.k5util.kdestroy()
-    assert out == 0
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kdestroy_nocache')
-def test_kcm_mem_kdestroy_nocache(setup_for_kcm_mem):
-    testenv = setup_for_kcm_mem
-    exercise_subsidiaries(testenv)
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__kdestroy_nocache')
-def test_kcm_secdb_kdestroy_nocache(setup_for_kcm_secdb):
-    testenv = setup_for_kcm_secdb
-    exercise_subsidiaries(testenv)
-
-
-def get_secrets_socket():
-    return os.path.join(config.RUNSTATEDIR, "secrets.socket")
-
-
-@pytest.mark.converted('test_kcm.py', 'test_kcm__tgt_renewal')
-@pytest.mark.skipif(not have_kcm_renewal(),
-                    reason="KCM renewal disabled, skipping")
-def test_kcm_renewals(setup_for_kcm_renewals_secdb):
-    """
-    Test that basic KCM renewal works
-    """
-    if "LC_TIME" in os.environ:
-        del os.environ["LC_TIME"]
-    testenv = setup_for_kcm_renewals_secdb
-    testenv.k5kdc.add_principal("user1", "Secret123")
-
-    ok = testenv.k5util.has_principal("user1@KCMTEST")
-    assert ok is False
-    nprincs = testenv.k5util.num_princs()
-    assert nprincs == 0
-
-    # Renewal is only performed after half of lifetime exceeded,
-    # see kcm_renew_all_tgts()
-    options = ["-r", "15s", "-l", "15s"]
-    out, _, _ = testenv.k5util.kinit("user1", "Secret123", options)
-    assert out == 0
-    nprincs = testenv.k5util.num_princs()
-    assert nprincs == 1
-
-    timestr_fmt = "%m/%d/%y %H:%M:%S"
-    initial_times = testenv.k5util.list_times()
-
-    # Wait for renewal to trigger once, after renew interval
-    time.sleep(15)
-
-    renewed_times = testenv.k5util.list_times()
-
-    init_times = initial_times.split()[0] + ' ' + initial_times.split()[1]
-    renew_times = renewed_times.split()[0] + ' ' + renewed_times.split()[1]
-    dt_init = datetime.strptime(init_times, timestr_fmt)
-    dt_renew = datetime.strptime(renew_times, timestr_fmt)
-    assert dt_renew > dt_init

From b4bca9822e6b375019d762ee2721b003cef923ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Fri, 27 Sep 2024 12:04:29 +0200
Subject: [PATCH 026/129] make_srpm: fallback to tar if git archive fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All copr builds are currently failing due to:
https://github.com/fedora-copr/copr/issues/3421

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 contrib/fedora/make_srpm.sh | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/contrib/fedora/make_srpm.sh b/contrib/fedora/make_srpm.sh
index f19b283e118..b82294970a4 100755
--- a/contrib/fedora/make_srpm.sh
+++ b/contrib/fedora/make_srpm.sh
@@ -166,10 +166,21 @@ sed -e "s/@PACKAGE_NAME@/$PACKAGE_NAME/" \
     > "$RPMBUILD/SPECS/$PACKAGE_NAME.spec"
 
 NAME="$PACKAGE_NAME-$PACKAGE_VERSION"
+TARBALL="$RPMBUILD/SOURCES/$NAME.tar.gz"
+
 git archive --format=tar --prefix="$NAME"/ \
             --remote="file://$SRC_DIR" \
-            HEAD \
-            | gzip > "$RPMBUILD/SOURCES/$NAME.tar.gz"
+            HEAD | gzip > "$TARBALL"
+
+# fallback to tar if git archive failed
+# tar may include more files so git archive is preferred
+tar -tzf "$TARBALL" &> /dev/null
+if [ $? -ne 0 ]; then
+    rm -f "$TARBALL"
+    pushd "$SRC_DIR"
+    tar -cvzf "$TARBALL" --transform "s,^,$NAME/," *
+    popd
+fi
 
 cp "$SRC_DIR"/contrib/*.patch "$RPMBUILD/SOURCES" 2>/dev/null
 add_patches "$RPMBUILD/SPECS/$PACKAGE_NAME.spec" \

From 8be21725aa0948371ab6ed8839877355930e6e77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Thu, 3 Oct 2024 12:04:53 +0200
Subject: [PATCH 027/129] conf: remove unused reconnection_retries

This option is no longer used since 9f8551a195cddc9ac898b90610be5fb30a16f4e4

Resolves: https://github.com/SSSD/sssd/issues/7502

:config: Option `reconnection_retries` was removed since it is no longer
  used. SSSD switch to a new architecte of internal IPC between SSSD
  processes where responders do not connect to backend anymore and
  therefore this option is no longer used.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 src/confdb/confdb.h                           |  1 -
 src/config/SSSDConfig/sssdoptions.py          |  1 -
 src/config/SSSDConfigTest.py                  | 25 --------------
 src/config/cfg_rules.ini                      | 10 ------
 src/config/etc/sssd.api.conf                  |  1 -
 .../testconfigs/sssd-enabled-option.conf      |  1 -
 .../testconfigs/sssd-invalid-badbool.conf     |  1 -
 src/config/testconfigs/sssd-noversion.conf    |  1 -
 src/config/testconfigs/sssd-valid.conf        |  1 -
 src/man/sssd.conf.5.xml                       | 26 ---------------
 src/tests/multihost/alltests/conftest.py      |  3 --
 src/tests/multihost/alltests/test_misc.py     | 33 -------------------
 .../multihost/alltests/test_multidomain.py    |  2 --
 13 files changed, 106 deletions(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index bf28db88b90..7457a1214af 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -58,7 +58,6 @@
 #define CONFDB_SERVICE_DEBUG_TIMESTAMPS "debug_timestamps"
 #define CONFDB_SERVICE_DEBUG_MICROSECONDS "debug_microseconds"
 #define CONFDB_SERVICE_DEBUG_BACKTRACE_ENABLED "debug_backtrace_enabled"
-#define CONFDB_SERVICE_RECON_RETRIES "reconnection_retries"
 #define CONFDB_SERVICE_FD_LIMIT "fd_limit"
 #define CONFDB_SERVICE_ALLOWED_UIDS "allowed_uids"
 
diff --git a/src/config/SSSDConfig/sssdoptions.py b/src/config/SSSDConfig/sssdoptions.py
index 8112548c805..affe2e52918 100644
--- a/src/config/SSSDConfig/sssdoptions.py
+++ b/src/config/SSSDConfig/sssdoptions.py
@@ -24,7 +24,6 @@ def __init__(self):
         'debug_backtrace_enabled': _('Enable/disable debug backtrace'),
         'timeout': _('Watchdog timeout before restarting service'),
         'command': _('Command to start service'),
-        'reconnection_retries': _('Number of times to attempt connection to Data Providers'),
         'fd_limit': _('The number of file descriptors that may be opened by this responder'),
         'client_idle_timeout': _('Idle time before automatic disconnection of a client'),
         'responder_idle_timeout': _('Idle time before automatic shutdown of the responder'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index ef4dcd295a7..bc398cc8b8e 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -77,8 +77,6 @@ def testServices(self):
 
         self.assertTrue('domains' in service_opts)
 
-        self.assertTrue('reconnection_retries' in service_opts)
-
         del sssdconfig
         sssdconfig = SSSDConfig.SSSDConfig(srcdir + "/etc/sssd.api.conf",
                                            srcdir + "/etc/sssd.api.d")
@@ -93,9 +91,6 @@ def testServices(self):
         self.assertTrue('command' in new_options)
         self.assertEqual(new_options['command'][0], str)
 
-        self.assertTrue('reconnection_retries' in new_options)
-        self.assertEqual(new_options['reconnection_retries'][0], int)
-
         self.assertTrue('services' in new_options)
         self.assertEqual(new_options['debug_level'][0], int)
 
@@ -338,7 +333,6 @@ def testListOptions(self):
             'debug_microseconds',
             'debug_backtrace_enabled',
             'command',
-            'reconnection_retries',
             'fd_limit',
             'client_idle_timeout',
             'responder_idle_timeout',
@@ -371,22 +365,6 @@ def testListOptions(self):
                             'Option [%s] unexpectedly found' %
                             option)
 
-        self.assertTrue(type(options['reconnection_retries']) == tuple,
-                        "Option values should be a tuple")
-
-        self.assertTrue(options['reconnection_retries'][0] == int,
-                        "reconnection_retries should require an int. "
-                        "list_options is requiring a %s" %
-                        options['reconnection_retries'][0])
-
-        self.assertTrue(options['reconnection_retries'][1] is None,
-                        "reconnection_retries should not require a subtype. "
-                        "list_options is requiring a %s" %
-                        options['reconnection_retries'][1])
-
-        self.assertTrue(options['reconnection_retries'][3] is None,
-                        "reconnection_retries should have no default")
-
         self.assertTrue(type(options['services']) == tuple,
                         "Option values should be a tuple")
 
@@ -1235,7 +1213,6 @@ def testImportConfig(self):
         # Verify that all options were imported for a section
         control_list = [
             'services',
-            'reconnection_retries',
             'domains',
             'debug_timestamps']
 
@@ -1292,7 +1269,6 @@ def testImportConfigNoVersion(self):
         service_list = sssd_service.get_option('services')
         self.assertTrue('nss' in service_list)
         self.assertTrue('pam' in service_list)
-        self.assertTrue('reconnection_retries' in service_opts)
 
         # Validate domain list
         domains = sssdconfig.list_domains()
@@ -2070,7 +2046,6 @@ def testEnabledOption(self):
         # Verify that all options were imported for [sssd] section
         control_list = [
             'services',
-            'reconnection_retries',
             'domains',
             'debug_timestamps']
 
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index e30680c3ccc..b33cd876b95 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -32,7 +32,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -68,7 +67,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -111,7 +109,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -158,7 +155,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -181,7 +177,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -202,7 +197,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -227,7 +221,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -250,7 +243,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -273,7 +265,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
@@ -360,7 +351,6 @@ option = debug_timestamps
 option = debug_microseconds
 option = debug_backtrace_enabled
 option = command
-option = reconnection_retries
 option = fd_limit
 option = client_idle_timeout
 option = description
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 28f057978db..b5d42afbb1e 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -10,7 +10,6 @@ debug_timestamps = bool, None, false
 debug_microseconds = bool, None, false
 debug_backtrace_enabled = bool, None, false
 command = str, None, false
-reconnection_retries = int, None, false
 fd_limit = int, None, false
 client_idle_timeout = int, None, false
 responder_idle_timeout = int, None, false
diff --git a/src/config/testconfigs/sssd-enabled-option.conf b/src/config/testconfigs/sssd-enabled-option.conf
index 6342e7354da..2a7c1d38458 100644
--- a/src/config/testconfigs/sssd-enabled-option.conf
+++ b/src/config/testconfigs/sssd-enabled-option.conf
@@ -3,7 +3,6 @@ debug_level = 0
 
 [sssd]
 services = nss, pam
-reconnection_retries = 3
 domains = enabled_1, enabled_3, disabled_3
 debug_timestamps = False
 
diff --git a/src/config/testconfigs/sssd-invalid-badbool.conf b/src/config/testconfigs/sssd-invalid-badbool.conf
index b3f6c92c01d..06d96a79fbf 100644
--- a/src/config/testconfigs/sssd-invalid-badbool.conf
+++ b/src/config/testconfigs/sssd-invalid-badbool.conf
@@ -10,7 +10,6 @@ nss_enum_cache_timeout = 120
 
 [sssd]
 services = nss, pam
-reconnection_retries = 3
 domains = PROXY, IPA
 
 [domain/PROXY]
diff --git a/src/config/testconfigs/sssd-noversion.conf b/src/config/testconfigs/sssd-noversion.conf
index aaeed6dba10..5c3489fb9e1 100644
--- a/src/config/testconfigs/sssd-noversion.conf
+++ b/src/config/testconfigs/sssd-noversion.conf
@@ -10,7 +10,6 @@ nss_enum_cache_timeout = 120
 
 [sssd]
 services = nss, pam
-reconnection_retries = 3
 domains = PROXY, IPA
 
 [domain/PROXY]
diff --git a/src/config/testconfigs/sssd-valid.conf b/src/config/testconfigs/sssd-valid.conf
index 07a29b8da25..66697ed4dee 100644
--- a/src/config/testconfigs/sssd-valid.conf
+++ b/src/config/testconfigs/sssd-valid.conf
@@ -10,7 +10,6 @@ nss_enum_cache_timeout = 120
 
 [sssd]
 services = nss, pam
-reconnection_retries = 3
 domains = IPA
 debug_timestamps = False
 
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 997bd00aa91..860ab94cf1e 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -247,19 +247,6 @@
                             </para>
                         </listitem>
                     </varlistentry>
-                    <varlistentry>
-                        <term>reconnection_retries (integer)</term>
-                        <listitem>
-                            <para>
-                                Number of times services should attempt to
-                                reconnect in the event of a Data Provider
-                                crash or restart before they give up
-                            </para>
-                            <para>
-                                Default: 3
-                            </para>
-                        </listitem>
-                    </varlistentry>
                     <varlistentry>
                         <term>domains</term>
                         <listitem>
@@ -777,19 +764,6 @@
                 These options can be used to configure any service.
             </para>
             <variablelist>
-                <varlistentry>
-                    <term>reconnection_retries (integer)</term>
-                    <listitem>
-                        <para>
-                            Number of times services should attempt to
-                            reconnect in the event of a Data Provider
-                            crash or restart before they give up
-                        </para>
-                        <para>
-                            Default: 3
-                        </para>
-                    </listitem>
-                </varlistentry>
                 <varlistentry>
                     <term>fd_limit</term>
                     <listitem>
diff --git a/src/tests/multihost/alltests/conftest.py b/src/tests/multihost/alltests/conftest.py
index 1182a9ca9a0..6e3758e992b 100644
--- a/src/tests/multihost/alltests/conftest.py
+++ b/src/tests/multihost/alltests/conftest.py
@@ -1506,11 +1506,8 @@ def ns_account_lock(session_multihost, request):
                      'ldap_account_expire_policy': '389DS',
                      'ldap_ns_account_lock': 'nsAccountlock'}
     client.sssd_conf(f'domain/{domain_name}', domain_params)
-    domain_params = {'reconnection_retries': '3'}
-    client.sssd_conf('pam', domain_params)
     domain_params = {'filter_groups': 'root',
                      'filter_users': 'root',
-                     'reconnection_retries': '3',
                      'debug_level': '9'}
     client.sssd_conf('nss', domain_params)
     session_multihost.client[0].service_sssd('restart')
diff --git a/src/tests/multihost/alltests/test_misc.py b/src/tests/multihost/alltests/test_misc.py
index 24d6a51575a..8ca71b3254f 100644
--- a/src/tests/multihost/alltests/test_misc.py
+++ b/src/tests/multihost/alltests/test_misc.py
@@ -81,39 +81,6 @@ def test_0001_ldapcachepurgetimeout(self,
         multihost.client[0].service_sssd('start')
         assert status == 'PASS'
 
-    @pytest.mark.tier1
-    def test_0002_offbyonereconn(self,
-                                 multihost, backupsssdconf):
-        """
-        :title: off by one in reconnection retries option intepretation
-        :id: 85c5357d-0cc4-4a32-b36a-00ed530865ad
-        :customerscenario: True
-        :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1801401
-        """
-        tools = sssdTools(multihost.client[0])
-        multihost.client[0].service_sssd('stop')
-        tools.remove_sss_cache('/var/lib/sss/db')
-        params = {'debug_level': '9',
-                  'reconnection_retries': '1'}
-        tools.sssd_conf('nss', params)
-        multihost.client[0].service_sssd('start')
-        kill_sssd_be = 'pkill sssd_be'
-        try:
-            multihost.client[0].run_command(kill_sssd_be, raiseonerr=False)
-        except subprocess.CalledProcessError:
-            pytest.fail("Unable to kill the sssd_be process")
-        time.sleep(3)
-        log_file = '/var/log/sssd/sssd_nss.log'
-        log_str = multihost.client[0].get_file_contents(log_file)
-        log1 = re.compile(r'Performing\sauto-reconnect')
-        result = log1.search(log_str.decode())
-        getent = 'getent passwd foo1@%s' % ds_instance_name
-        cmd = multihost.client[0].run_command(getent, raiseonerr=False)
-        multihost.client[0].service_sssd('stop')
-        tools.sssd_conf('nss', params, action='delete')
-        multihost.client[0].service_sssd('start')
-        assert result is not None or cmd.returncode == 0
-
     @pytest.mark.tier1
     def test_0003_sssd_crashes_after_update(self, multihost,
                                             backupsssdconf):
diff --git a/src/tests/multihost/alltests/test_multidomain.py b/src/tests/multihost/alltests/test_multidomain.py
index 12ed47b5328..cb037b285e6 100644
--- a/src/tests/multihost/alltests/test_multidomain.py
+++ b/src/tests/multihost/alltests/test_multidomain.py
@@ -511,8 +511,6 @@ def test_0023_ldapldap(multihost, multidomain_sssd):
             domain_section = 'domain/ldap%d' % (idx + 1)
             client_tools.sssd_conf(domain_section, params)
         domains = ['ldap1, ldap2', 'ldap2, ldap1']
-        sssd_params = {'reconnection_retries': '3'}
-        client_tools.sssd_conf('sssd', sssd_params)
         for domain in domains:
             sssd_params = {'domains': domain}
             client_tools.sssd_conf('sssd', sssd_params)

From 1c91ea05cec9882d671283099c1647595229487a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Fri, 27 Sep 2024 17:08:16 +0200
Subject: [PATCH 028/129] MONITOR: Link DbusConnection and sbus_connection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although related, the DbusConnection and its associated sbus_connection
had no link in the logs. We had this:

```
[sbus_server_new_connection] (0x0200): Adding connection 0x11fe700.
...
[sbus_server_bus_hello] (0x4000): Assigning unique name :1.3 to connection 0x11e4a90
```

Now we have:
```
[sbus_server_new_connection] (0x0200): New dbus connection 0x11fe700.
...
[sbus_server_new_connection] (0x0200): Adding sbus connection 0x11e4a90.
...
[sbus_server_bus_hello] (0x4000): Assigning unique name :1.3 to connection 0x11e4a90
```

Which allows to establish the relationship between them: the new
sbus connection is associated to the preceding dbus connection. Both
messages are logged by the same function.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/sbus/server/sbus_server.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/sbus/server/sbus_server.c b/src/sbus/server/sbus_server.c
index 83b99821b5a..b58575e8f5f 100644
--- a/src/sbus/server/sbus_server.c
+++ b/src/sbus/server/sbus_server.c
@@ -405,7 +405,7 @@ sbus_server_new_connection(DBusServer *dbus_server,
 
     sbus_server = talloc_get_type(data, struct sbus_server);
 
-    DEBUG(SSSDBG_FUNC_DATA, "Adding connection %p.\n", dbus_conn);
+    DEBUG(SSSDBG_FUNC_DATA, "New dbus connection %p.\n", dbus_conn);
 
     /* First, add a message filter that will take care of routing messages
      * between connections. */
@@ -429,6 +429,7 @@ sbus_server_new_connection(DBusServer *dbus_server,
         dbus_connection_close(dbus_conn);
         return;
     }
+    DEBUG(SSSDBG_FUNC_DATA, "Adding sbus connection %p.\n", sbus_conn);
 
     dbret = dbus_connection_set_data(dbus_conn, sbus_server->data_slot,
                                      sbus_conn, NULL);

From e0ec488c13607808715172299666ad4176f03f8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Mon, 7 Oct 2024 13:36:36 +0200
Subject: [PATCH 029/129] MONITOR: Set destructor for the right connection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the monitor receives a `sssd.monitor.RegisterService` D-Bus method,
it is received on the listening connection and not on the client's
connection. Because of this, the destructor is set for to the listening
connection (taken from the sbus_request) and instead of the client
connection.

The client connection can be retrieved searching it by the sender's
name in the `sbus_server` accessible from the `mt_ctx`, to set the
destructor to the correct connection in the function
`monitor_sbus_RegisterService()`.

Resolves: https://github.com/SSSD/sssd/issues/6897

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/monitor/monitor.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index 6366c0dee12..75195e54398 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -261,7 +261,12 @@ monitor_sbus_RegisterService(TALLOC_CTX *mem_ctx,
     }
 
     /* Fill in svc structure with connection data */
-    svc->conn = sbus_req->conn;
+    svc->conn = sbus_server_find_connection(mt_ctx->sbus_server, svc->busname);
+    if (svc->conn == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Bug: No connection found for '%s'\n", svc->busname);
+        return ERR_SBUS_KILL_CONNECTION;
+    }
 
     /* For {dbus,socket}-activated services we will have to unregister then
      * when the sbus_connection is freed. That's the reason we have to

From 263cb2e736ba2eea80b1ab2c62ecf6d945d8ea0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Thu, 3 Oct 2024 14:30:32 +0200
Subject: [PATCH 030/129] sbus: terminate ongoing chained requests if backend
 is restarted

If there is an outgoing request already chained and backend is
restarted, a new outgoing request is chained but not processed,
it waits for a timeout.

This patch makes sure that all outgoing requests are gracefully
terminated if backend restarts.

Resolves: https://github.com/SSSD/sssd/issues/7503

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
---
 src/sbus/connection/sbus_connection.c   | 17 +++++++++
 src/sbus/connection/sbus_dispatcher.c   |  1 +
 src/sbus/interface/sbus_std_signals.c   |  5 +++
 src/sbus/request/sbus_request.c         | 13 +++++--
 src/sbus/request/sbus_request_hash.c    | 40 +++++++++++++++++++++
 src/sbus/sbus.h                         | 10 ++++++
 src/sbus/sbus_private.h                 | 10 ++++++
 src/tests/system/tests/test_identity.py | 46 ++++++++++++++++++++++++-
 8 files changed, 138 insertions(+), 4 deletions(-)

diff --git a/src/sbus/connection/sbus_connection.c b/src/sbus/connection/sbus_connection.c
index a5d11f67276..59fc2ee6b81 100644
--- a/src/sbus/connection/sbus_connection.c
+++ b/src/sbus/connection/sbus_connection.c
@@ -471,3 +471,20 @@ void sbus_connection_free(struct sbus_connection *conn)
               conn);
     }
 }
+
+void
+sbus_connection_terminate_member_requests(struct sbus_connection *conn,
+                                          const char *member)
+{
+    DEBUG(SSSDBG_TRACE_FUNC, "Terminating outgoing chained requests for: %s\n",
+          member);
+
+    sbus_requests_terminate_member(conn->requests->outgoing, member,
+                                   ERR_TERMINATED);
+
+    DEBUG(SSSDBG_TRACE_FUNC, "Terminating incoming chained requests from: %s\n",
+          member);
+
+    sbus_requests_terminate_member(conn->requests->incoming, member,
+                                   ERR_TERMINATED);
+}
diff --git a/src/sbus/connection/sbus_dispatcher.c b/src/sbus/connection/sbus_dispatcher.c
index 3631c175472..7d954fe7901 100644
--- a/src/sbus/connection/sbus_dispatcher.c
+++ b/src/sbus/connection/sbus_dispatcher.c
@@ -38,6 +38,7 @@ sbus_dispatch_reconnect(struct sbus_connection *conn)
     /* Terminate all outgoing requests associated with this connection. */
     DEBUG(SSSDBG_TRACE_FUNC, "Connection lost. Terminating active requests.\n");
     sbus_requests_terminate_all(conn->requests->outgoing, ERR_TERMINATED);
+    sbus_requests_terminate_all(conn->requests->incoming, ERR_TERMINATED);
 
     switch (conn->type) {
     case SBUS_CONNECTION_CLIENT:
diff --git a/src/sbus/interface/sbus_std_signals.c b/src/sbus/interface/sbus_std_signals.c
index c9afe445d67..231765d4fa6 100644
--- a/src/sbus/interface/sbus_std_signals.c
+++ b/src/sbus/interface/sbus_std_signals.c
@@ -37,6 +37,11 @@ sbus_name_owner_changed(TALLOC_CTX *mem_ctx,
     /* Delete any existing sender information since it is now obsolete. */
     sbus_senders_delete(conn->senders, name);
 
+    /* Terminate active request if the owner has disconnected. */
+    if (new_owner == NULL || new_owner[0] == '\0') {
+        sbus_connection_terminate_member_requests(sbus_req->conn, old_owner);
+    }
+
     return EOK;
 }
 
diff --git a/src/sbus/request/sbus_request.c b/src/sbus/request/sbus_request.c
index e0ea7c3a73e..845bc441fb9 100644
--- a/src/sbus/request/sbus_request.c
+++ b/src/sbus/request/sbus_request.c
@@ -449,6 +449,7 @@ static void sbus_incoming_request_sender_done(struct tevent_req *subreq)
     DBusMessageIter *write_iter = NULL;
     struct sbus_sender *sender;
     struct tevent_req *req;
+    const char *member = NULL;
     bool key_exists;
     errno_t ret;
 
@@ -463,6 +464,9 @@ static void sbus_incoming_request_sender_done(struct tevent_req *subreq)
     }
 
     state->request->sender = talloc_steal(state->request, sender);
+    if (sender != NULL) {
+        member = sender->name;
+    }
 
     ret = sbus_check_access(state->conn, state->request);
     if (ret != EOK) {
@@ -500,7 +504,7 @@ static void sbus_incoming_request_sender_done(struct tevent_req *subreq)
      * set a tevent callback that is triggered when the method handler is done.
      */
     ret = sbus_requests_add(state->conn->requests->incoming, state->key,
-                            state->conn, req, true, &key_exists);
+                            state->conn, req, member, true, &key_exists);
     if (ret != EOK || key_exists) {
         /* Cancel the sub request. Since there was either an error or the
          * sub request was chained. */
@@ -617,6 +621,7 @@ sbus_outgoing_request_send(TALLOC_CTX *mem_ctx,
     struct sbus_outgoing_request_state *state;
     struct tevent_req *subreq;
     struct tevent_req *req;
+    const char *destination;
     bool key_exists;
     errno_t ret;
 
@@ -645,6 +650,8 @@ sbus_outgoing_request_send(TALLOC_CTX *mem_ctx,
         }
     }
 
+    destination = dbus_message_get_destination(msg);
+
     /**
      * We will search table to see if the same request is not already
      * in progress. If it is, we register ourselves for notification
@@ -654,7 +661,7 @@ sbus_outgoing_request_send(TALLOC_CTX *mem_ctx,
      * set a tevent callback that is triggered when the method handler is done.
      */
     ret = sbus_requests_add(conn->requests->outgoing, key,
-                            conn, req, true, &key_exists);
+                            conn, req, destination, true, &key_exists);
     if (ret != EOK) {
         goto done;
     }
@@ -776,7 +783,7 @@ sbus_request_await_send(TALLOC_CTX *mem_ctx,
 
     /* Otherwise attach to this request. */
     ret = sbus_requests_add(conn->requests->outgoing, key, conn,
-                            req, false, NULL);
+                            req, member, false, NULL);
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Unable to attach to the request list "
               "[%d]: %s\n", ret, sss_strerror(ret));
diff --git a/src/sbus/request/sbus_request_hash.c b/src/sbus/request/sbus_request_hash.c
index 0ddad03a87b..532c54795a4 100644
--- a/src/sbus/request/sbus_request_hash.c
+++ b/src/sbus/request/sbus_request_hash.c
@@ -118,6 +118,7 @@ sbus_requests_add(hash_table_t *table,
                   const char *key,
                   struct sbus_connection *conn,
                   struct tevent_req *req,
+                  const char *member,
                   bool is_dbus,
                   bool *_key_exists)
 {
@@ -150,6 +151,11 @@ sbus_requests_add(hash_table_t *table,
     item->req = req;
     item->conn = conn;
     item->is_dbus = is_dbus;
+    item->member = talloc_strdup(item, member);
+    if (member != NULL && item->member == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
 
     ret = sbus_requests_attach_spies(item);
     if (ret != EOK) {
@@ -323,3 +329,37 @@ sbus_requests_terminate_all(hash_table_t *table,
 
     talloc_free(values);
 }
+
+void
+sbus_requests_terminate_member(hash_table_t *table,
+                               const char *member,
+                               errno_t error)
+{
+    struct sbus_request_list *list;
+    struct sbus_request_list *item;
+    hash_value_t *values;
+    unsigned long int num;
+    unsigned long int i;
+    int hret;
+
+    hret = hash_values(table, &num, &values);
+    if (hret != HASH_SUCCESS) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to get list of active requests "
+              "[%d]: %s\n", hret, hash_error_string(hret));
+        return;
+    }
+
+    for (i = 0; i < num; i++) {
+        list = sss_ptr_get_value(&values[i], struct sbus_request_list);
+        if ((member == NULL && list->member == NULL)
+            || (member != NULL && list->member != NULL && strcmp(member, list->member) == 0)) {
+            DLIST_FOR_EACH(item, list) {
+                sbus_requests_finish(item, error);
+            }
+        }
+
+        sbus_requests_delete(list);
+    }
+
+    talloc_free(values);
+}
diff --git a/src/sbus/sbus.h b/src/sbus/sbus.h
index c5f564f20ac..9f17b91b747 100644
--- a/src/sbus/sbus.h
+++ b/src/sbus/sbus.h
@@ -336,6 +336,16 @@ errno_t
 sbus_connection_add_path_map(struct sbus_connection *conn,
                              struct sbus_path *map);
 
+/**
+ * Terminate all outgoing requests for given member.
+ *
+ * @param conn      An sbus connection.
+ * @param member D-Bus member name (destination)
+ */
+void
+sbus_connection_terminate_member_requests(struct sbus_connection *conn,
+                                          const char *member);
+
 /**
  * Add new signal listener to the router.
  *
diff --git a/src/sbus/sbus_private.h b/src/sbus/sbus_private.h
index a55709086bb..b27a3b4c1c4 100644
--- a/src/sbus/sbus_private.h
+++ b/src/sbus/sbus_private.h
@@ -431,6 +431,9 @@ struct sbus_request_list {
     struct tevent_req *req;
     struct sbus_connection *conn;
 
+    /* Member part of the key. Destination for outgoing, sender for incoming.*/
+    const char *member;
+
     bool is_invalid;
     bool is_dbus;
 
@@ -462,6 +465,7 @@ sbus_requests_add(hash_table_t *table,
                   const char *key,
                   struct sbus_connection *conn,
                   struct tevent_req *req,
+                  const char *member,
                   bool is_dbus,
                   bool *_key_exists);
 
@@ -484,6 +488,12 @@ void
 sbus_requests_terminate_all(hash_table_t *table,
                             errno_t error);
 
+/* Terminate requests associated with given member. */
+void
+sbus_requests_terminate_member(hash_table_t *table,
+                               const char *member,
+                               errno_t error);
+
 /* Create new sbus request. */
 struct sbus_request *
 sbus_request_create(TALLOC_CTX *mem_ctx,
diff --git a/src/tests/system/tests/test_identity.py b/src/tests/system/tests/test_identity.py
index bf50a7d0403..e92d10c016c 100644
--- a/src/tests/system/tests/test_identity.py
+++ b/src/tests/system/tests/test_identity.py
@@ -12,7 +12,8 @@
 from sssd_test_framework.roles.client import Client
 from sssd_test_framework.roles.generic import GenericADProvider, GenericProvider
 from sssd_test_framework.roles.ipa import IPA
-from sssd_test_framework.topology import KnownTopologyGroup
+from sssd_test_framework.roles.ldap import LDAP
+from sssd_test_framework.topology import KnownTopology, KnownTopologyGroup
 
 
 @pytest.mark.importance("critical")
@@ -681,3 +682,46 @@ def test_identity__lookup_when_auto_private_groups_is_set_to_hybrid(client: Clie
     assert result is not None, "User 'user_group_gid' not found!"
     assert result.gid == 555555, "gid does not match expected value!"
     assert client.tools.getent.group(555555) is not None, "auto private group not found!"
+
+
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_identity__lookup_when_backend_restarts(client: Client, ldap: LDAP):
+    """
+    :title: Look up user when backend is restarted with previous lookup unfinished
+    :description:
+        If there is an active lookup for a user and the backend is restarted
+        before this lookup is finished, the next lookup of the same user after
+        the restart must not timeout.
+    :setup:
+        1. Add a user "tuser"
+        2. Start SSSD
+    :steps:
+        1. Add 10s network traffic delay to the LDAP host
+        2. Lookup "tuser" asynchronously
+        3. Kill sssd_be with SIGKILL so it is restarted
+        4. Remove the network traffic delay
+        5. Lookup of "tuser" must yield the user and not timeout
+    :expectedresults:
+        1. Network traffic is delayed
+        2. Lookup hangs, does not finish and waits for a timeout
+        3. The backend process is restarted
+        4. Network traffic is no longer delayed
+        5. User lookup returns the user immediately
+    :customerscenario: False
+    """
+    ldap.user("tuser").add()
+
+    client.sssd.start()
+
+    # Add a delay so the next lookup will hang
+    client.tc.add_delay(ldap, "10s")
+    client.host.conn.async_run("getent passwd tuser")
+
+    # Kill backend and remove the delay
+    client.host.conn.run("kill -KILL $(pidof sssd_be)")
+    client.tc.remove_delay(ldap)
+
+    # The next lookup should not timeout
+    result = client.tools.wait_for_condition("getent passwd tuser", timeout=5)
+    assert "tuser" in result.stdout, "tuser was not found"

From c1434c1aee47247097cacc2d0f11f9a8c4e6284e Mon Sep 17 00:00:00 2001
From: Pavel Raiskup <praiskup@redhat.com>
Date: Mon, 14 Oct 2024 07:27:40 +0200
Subject: [PATCH 031/129] rpm: drop the --remote argument from git-archive call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It seems that current (autumn 2024) git releases somehow dislike
the use of `--remote=file://` when it applies the [safe] directory
checks.  The option doesn't seem to be useful though, so let's drop
it to fix the Copr builds.

Relates: https://github.com/fedora-copr/copr/issues/3421

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 contrib/fedora/make_srpm.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/contrib/fedora/make_srpm.sh b/contrib/fedora/make_srpm.sh
index b82294970a4..59b625183cd 100755
--- a/contrib/fedora/make_srpm.sh
+++ b/contrib/fedora/make_srpm.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -x
 
 #    Authors:
 #        Lukas Slebodnik <lslebodn@redhat.com>
@@ -169,7 +169,6 @@ NAME="$PACKAGE_NAME-$PACKAGE_VERSION"
 TARBALL="$RPMBUILD/SOURCES/$NAME.tar.gz"
 
 git archive --format=tar --prefix="$NAME"/ \
-            --remote="file://$SRC_DIR" \
             HEAD | gzip > "$TARBALL"
 
 # fallback to tar if git archive failed

From 17c37e44417d85fc6db3cd6ca093aa051047c1e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20V=C3=A1vra?= <jvavra@redhat.com>
Date: Fri, 27 Sep 2024 08:21:31 +0200
Subject: [PATCH 032/129] tests: Update ldap test to use journal utility.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Madhuri Upadhye <mupadhye@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/tests/system/tests/test_ldap.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/tests/system/tests/test_ldap.py b/src/tests/system/tests/test_ldap.py
index c7155223dbd..3d8b35a451c 100644
--- a/src/tests/system/tests/test_ldap.py
+++ b/src/tests/system/tests/test_ldap.py
@@ -144,10 +144,8 @@ def test_ldap__password_change_new_password_does_not_meet_complexity_requirement
         "user1", "Secret123", "red_32"
     ), "Password should not have been able to be changed!"
 
-    assert (
-        "pam_sss(passwd:chauthtok): User info message: Password change failed."
-        in client.host.conn.run("journalctl").stdout
-    )
+    match = client.journald.is_match(r"pam_sss\(passwd:chauthtok\): User info message: Password change failed.")
+    assert match, "'Password change failed.' message is not in log!"
 
 
 @pytest.mark.ticket(bz=[1695574, 1795220])

From 36d8289250d3829a6b38c9b4ef9f89dfe151e41a Mon Sep 17 00:00:00 2001
From: Samuel Cabrero <scabrero@suse.de>
Date: Wed, 4 Sep 2024 12:33:21 +0200
Subject: [PATCH 033/129] BE: Maintain the list of periodic tasks

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/backend.h          |  3 +++
 src/providers/be_ptask.c         | 11 +++++++++++
 src/providers/be_ptask.h         |  1 +
 src/providers/be_ptask_private.h |  3 +++
 4 files changed, 18 insertions(+)

diff --git a/src/providers/backend.h b/src/providers/backend.h
index ff2c7f63a77..96dc611dec2 100644
--- a/src/providers/backend.h
+++ b/src/providers/backend.h
@@ -117,6 +117,9 @@ struct be_ctx {
      * DP_ERR_OK or DP_ERR_OFFLINE. The only usage of this var, so far, is
      * to log the DP status without spamming the syslog/journal. */
     int last_dp_state;
+
+    /* List of periodic tasks */
+    struct be_ptask *tasks;
 };
 
 bool be_is_offline(struct be_ctx *ctx);
diff --git a/src/providers/be_ptask.c b/src/providers/be_ptask.c
index 1d6bd9ace40..29a00d719ca 100644
--- a/src/providers/be_ptask.c
+++ b/src/providers/be_ptask.c
@@ -51,6 +51,8 @@ static int be_ptask_destructor(void *pvt)
         return 0;
     }
 
+    DLIST_REMOVE(task->be_ctx->tasks, task);
+
     DEBUG(SSSDBG_TRACE_FUNC, "Terminating periodic task [%s]\n", task->name);
 
     return 0;
@@ -351,6 +353,8 @@ errno_t be_ptask_create(TALLOC_CTX *mem_ctx,
 
     talloc_set_destructor((TALLOC_CTX*)task, be_ptask_destructor);
 
+    DLIST_ADD(be_ctx->tasks, task);
+
     if (flags & BE_PTASK_OFFLINE_DISABLE) {
         /* install offline and online callbacks */
         ret = be_add_online_cb(task, be_ctx, be_ptask_online_cb, task, NULL);
@@ -432,6 +436,13 @@ void be_ptask_postpone(struct be_ptask *task)
     be_ptask_schedule(task, BE_PTASK_PERIOD, BE_PTASK_SCHEDULE_FROM_NOW);
 }
 
+void be_ptask_postpone_all(struct be_ctx *be_ctx) {
+    struct be_ptask *task = NULL;
+    DLIST_FOR_EACH(task, be_ctx->tasks) {
+        be_ptask_postpone(task);
+    }
+}
+
 void be_ptask_destroy(struct be_ptask **task)
 {
     talloc_zfree(*task);
diff --git a/src/providers/be_ptask.h b/src/providers/be_ptask.h
index 0c5f1fb7f1b..9928b855ddf 100644
--- a/src/providers/be_ptask.h
+++ b/src/providers/be_ptask.h
@@ -143,6 +143,7 @@ errno_t be_ptask_create_sync(TALLOC_CTX *mem_ctx,
 void be_ptask_enable(struct be_ptask *task);
 void be_ptask_disable(struct be_ptask *task);
 void be_ptask_postpone(struct be_ptask *task);
+void be_ptask_postpone_all(struct be_ctx *be_ctx);
 void be_ptask_destroy(struct be_ptask **task);
 
 time_t be_ptask_get_period(struct be_ptask *task);
diff --git a/src/providers/be_ptask_private.h b/src/providers/be_ptask_private.h
index 39719358800..9b90e32ed83 100644
--- a/src/providers/be_ptask_private.h
+++ b/src/providers/be_ptask_private.h
@@ -42,6 +42,9 @@ struct be_ptask {
     struct tevent_timer *timer; /* active tevent timer */
     uint32_t flags;
     bool enabled;
+
+    struct be_ptask *prev;
+    struct be_ptask *next;
 };
 
 #endif /* DP_PTASK_PRIVATE_H_ */

From 423e5b93773b1552b0c60caad130fad2dda5ccdf Mon Sep 17 00:00:00 2001
From: Samuel Cabrero <scabrero@suse.de>
Date: Wed, 18 Sep 2024 14:13:01 +0200
Subject: [PATCH 034/129] WATCHDOG: Use a constant instead of the signal name

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/util/util.h          | 2 ++
 src/util/util_watchdog.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/util/util.h b/src/util/util.h
index 406c4178589..d3767f2a699 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -219,6 +219,8 @@ int server_setup(const char *name, bool is_responder,
 void server_loop(struct main_context *main_ctx);
 void orderly_shutdown(int status);
 
+#define SSSSIG_RESET_WATCHDOG         SIGRTMIN
+
 /* from signal.c */
 void BlockSignals(bool block, int signum);
 void (*CatchSignal(int signum,void (*handler)(int )))(int);
diff --git a/src/util/util_watchdog.c b/src/util/util_watchdog.c
index abafd94b91e..9d6c1425c7f 100644
--- a/src/util/util_watchdog.c
+++ b/src/util/util_watchdog.c
@@ -175,7 +175,7 @@ int setup_watchdog(struct tevent_context *ev, int interval)
     struct sigevent sev;
     struct itimerspec its;
     struct tevent_fd *tfd;
-    int signum = SIGRTMIN;
+    int signum = SSSSIG_RESET_WATCHDOG;
     int ret;
 
     memset(&sev, 0, sizeof(sev));

From fae131ad41b714f1fca4247990ca40dc19f72c63 Mon Sep 17 00:00:00 2001
From: Samuel Cabrero <scabrero@suse.de>
Date: Wed, 4 Sep 2024 12:35:03 +0200
Subject: [PATCH 035/129] WATCHDOG: Send SIGRTMIN+1 signal when clock shift is
 detected

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/util/util.h          | 1 +
 src/util/util_watchdog.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/src/util/util.h b/src/util/util.h
index d3767f2a699..ea7bd150d71 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -220,6 +220,7 @@ void server_loop(struct main_context *main_ctx);
 void orderly_shutdown(int status);
 
 #define SSSSIG_RESET_WATCHDOG         SIGRTMIN
+#define SSSSIG_TIME_SHIFT_DETECTED    SIGRTMIN+1
 
 /* from signal.c */
 void BlockSignals(bool block, int signum);
diff --git a/src/util/util_watchdog.c b/src/util/util_watchdog.c
index 9d6c1425c7f..a6677359dc6 100644
--- a/src/util/util_watchdog.c
+++ b/src/util/util_watchdog.c
@@ -167,6 +167,8 @@ static void watchdog_fd_read_handler(struct tevent_context *ev,
     if (strncmp(debug_prg_name, "be[", sizeof("be[") - 1) == 0) {
         kill(getpid(), SIGUSR2);
         DEBUG(SSSDBG_IMPORTANT_INFO, "SIGUSR2 sent to %s\n", debug_prg_name);
+        kill(getpid(), SSSSIG_TIME_SHIFT_DETECTED);
+        DEBUG(SSSDBG_IMPORTANT_INFO, "SSSSIG_TIME_SHIFT_DETECTED sent to %s\n", debug_prg_name);
     }
 }
 

From 07ce89e14e3de75ef842cac22efd81fc42407f35 Mon Sep 17 00:00:00 2001
From: Samuel Cabrero <scabrero@suse.de>
Date: Thu, 5 Sep 2024 12:13:04 +0200
Subject: [PATCH 036/129] BE: Handle SIGRTMIN+1 signal to reschedule periodic
 tasks

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/data_provider_be.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
index df653f1691b..f8e90a0486e 100644
--- a/src/providers/data_provider_be.c
+++ b/src/providers/data_provider_be.c
@@ -474,6 +474,17 @@ static void signal_be_reset_offline(struct tevent_context *ev,
     check_if_online(ctx, 0);
 }
 
+static void signal_be_reschedule_tasks(struct tevent_context *ev,
+                                       struct tevent_signal *se,
+                                       int signum,
+                                       int count,
+                                       void *siginfo,
+                                       void *private_data)
+{
+    struct be_ctx *ctx = talloc_get_type(private_data, struct be_ctx);
+    be_ptask_postpone_all(ctx);
+}
+
 static void watch_update_resolv(const char *filename, void *arg)
 {
     int ret;
@@ -719,6 +730,17 @@ errno_t be_process_init(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
+    /* Handle SSSSIG_TIME_SHIFT_DETECTED (reschedule tasks) */
+    BlockSignals(false, SSSSIG_TIME_SHIFT_DETECTED);
+    tes = tevent_add_signal(be_ctx->ev, be_ctx, SSSSIG_TIME_SHIFT_DETECTED, 0,
+                            signal_be_reschedule_tasks, be_ctx);
+    if (tes == NULL) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "Unable to setup SSSSIG_TIME_SHIFT_DETECTED handler\n");
+        ret = EIO;
+        goto done;
+    }
+
     /* Set up watchers for system config files and the net links */
     ret = watch_config_files(be_ctx);
     if (ret != EOK) {

From fdf7e75ce85bf2ca9202f6ce24cb2c939b97b600 Mon Sep 17 00:00:00 2001
From: Samuel Cabrero <scabrero@suse.de>
Date: Thu, 5 Sep 2024 12:29:23 +0200
Subject: [PATCH 037/129] MAN: Document SIGRTMIN+1 signal usage

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/man/sssd.8.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/man/sssd.8.xml b/src/man/sssd.8.xml
index 867d97274dd..abd2cf2a170 100644
--- a/src/man/sssd.8.xml
+++ b/src/man/sssd.8.xml
@@ -204,6 +204,18 @@
                     </para>
                 </listitem>
             </varlistentry>
+            <varlistentry>
+                <term>SIGRTMIN+1</term>
+                <listitem>
+                    <para>
+                        Tells the SSSD to reschedule the periodic tasks. The
+                        internal watchdog sends this signal to the providers
+                        when a clock shift is detected although it can be sent
+                        to any sssd_be process directly.
+                    </para>
+                </listitem>
+            </varlistentry>
+
         </variablelist>
     </refsect1>
 

From c9026bf09afa0e917f3778a2ab9d068de449c483 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 10:02:21 +0200
Subject: [PATCH 038/129] Move 'nscd' helper functions out of 'utils'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

as it's not used anywhere outside 'monitor'.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                  |  3 +--
 src/monitor/monitor.c        | 41 ++----------------------------------
 src/{util => monitor}/nscd.c | 41 +++++++++++++++++++++++++++++++++++-
 src/util/util.h              |  3 ---
 4 files changed, 43 insertions(+), 45 deletions(-)
 rename src/{util => monitor}/nscd.c (67%)

diff --git a/Makefile.am b/Makefile.am
index 2c3ff5f0da0..f13bc3799bf 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -633,7 +633,6 @@ SSSD_TOOLS_OBJ = \
     src/tools/common/sss_tools.c \
     src/tools/common/sss_process.c \
     src/confdb/confdb_setup.c \
-    src/util/nscd.c \
     $(NULL)
 
 SSSD_LCL_TOOLS_OBJ = \
@@ -1519,8 +1518,8 @@ endif
 sssd_SOURCES = \
     src/monitor/monitor.c \
     src/monitor/monitor_bootstrap.c \
+    src/monitor/nscd.c \
     src/confdb/confdb_setup.c \
-    src/util/nscd.c \
     $(NULL)
 sssd_LDADD = \
     $(SSSD_LIBS) \
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index 75195e54398..f86574d24ae 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -66,11 +66,6 @@
  */
 #define KRB5_RCACHE_DIR_DISABLE "__LIBKRB5_DEFAULTS__"
 
-/* for detecting if NSCD is running */
-#ifndef NSCD_SOCKET_PATH
-#define NSCD_SOCKET_PATH "/var/run/nscd/socket"
-#endif
-
 int cmdline_debug_level;
 int cmdline_debug_timestamps;
 int cmdline_debug_microseconds;
@@ -1895,40 +1890,8 @@ static void monitor_restart_service(struct mt_svc *svc)
     }
 }
 
-static void check_nscd(void)
-{
-    int ret;
-    ret = check_file(NSCD_SOCKET_PATH,
-                     -1, -1, S_IFSOCK, S_IFMT, NULL, false);
-    if (ret == EOK) {
-        ret = sss_nscd_parse_conf(NSCD_CONF_PATH);
-
-        switch (ret) {
-            case ENOENT:
-                sss_log(SSS_LOG_NOTICE,
-                        "NSCD socket was detected. NSCD caching capabilities "
-                        "may conflict with SSSD for users and groups. It is "
-                        "recommended not to run NSCD in parallel with SSSD, "
-                        "unless NSCD is configured not to cache the passwd, "
-                        "group, netgroup and services nsswitch maps.");
-                break;
-
-            case EEXIST:
-                sss_log(SSS_LOG_NOTICE,
-                        "NSCD socket was detected and seems to be configured "
-                        "to cache some of the databases controlled by "
-                        "SSSD [passwd,group,netgroup,services]. It is "
-                        "recommended not to run NSCD in parallel with SSSD, "
-                        "unless NSCD is configured not to cache these.");
-                break;
-
-            case EOK:
-                DEBUG(SSSDBG_TRACE_FUNC, "NSCD socket was detected and it "
-                            "seems to be configured not to interfere with "
-                            "SSSD's caching capabilities\n");
-        }
-    }
-}
+/* from nscd.c */
+void check_nscd(void);
 
 #ifdef BUILD_CONF_SERVICE_USER_SUPPORT
 int bootstrap_monitor_process(uid_t target_uid, gid_t target_gid);
diff --git a/src/util/nscd.c b/src/monitor/nscd.c
similarity index 67%
rename from src/util/nscd.c
rename to src/monitor/nscd.c
index 47a1c023a76..c973a86dece 100644
--- a/src/util/nscd.c
+++ b/src/monitor/nscd.c
@@ -25,6 +25,10 @@
 
 #include "util/util.h"
 
+#ifndef NSCD_SOCKET_PATH
+#define NSCD_SOCKET_PATH "/var/run/nscd/socket"
+#endif
+
 
 /* NSCD config file parse and check */
 static unsigned int sss_nscd_check_service(char* svc_name)
@@ -59,7 +63,7 @@ static unsigned int sss_nscd_check_service(char* svc_name)
     return ret;
 }
 
-errno_t sss_nscd_parse_conf(const char *conf_path)
+static errno_t sss_nscd_parse_conf(const char *conf_path)
 {
     FILE *fp;
     int ret = EOK;
@@ -144,3 +148,38 @@ errno_t sss_nscd_parse_conf(const char *conf_path)
 
     return ret;
 }
+
+void check_nscd(void)
+{
+    int ret;
+    ret = check_file(NSCD_SOCKET_PATH,
+                     -1, -1, S_IFSOCK, S_IFMT, NULL, false);
+    if (ret == EOK) {
+        ret = sss_nscd_parse_conf(NSCD_CONF_PATH);
+
+        switch (ret) {
+            case ENOENT:
+                sss_log(SSS_LOG_NOTICE,
+                        "NSCD socket was detected. NSCD caching capabilities "
+                        "may conflict with SSSD for users and groups. It is "
+                        "recommended not to run NSCD in parallel with SSSD, "
+                        "unless NSCD is configured not to cache the passwd, "
+                        "group, netgroup and services nsswitch maps.");
+                break;
+
+            case EEXIST:
+                sss_log(SSS_LOG_NOTICE,
+                        "NSCD socket was detected and seems to be configured "
+                        "to cache some of the databases controlled by "
+                        "SSSD [passwd,group,netgroup,services]. It is "
+                        "recommended not to run NSCD in parallel with SSSD, "
+                        "unless NSCD is configured not to cache these.");
+                break;
+
+            case EOK:
+                DEBUG(SSSDBG_TRACE_FUNC, "NSCD socket was detected and it "
+                            "seems to be configured not to interfere with "
+                            "SSSD's caching capabilities\n");
+        }
+    }
+}
diff --git a/src/util/util.h b/src/util/util.h
index ea7bd150d71..a25b55ef396 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -563,9 +563,6 @@ bool is_valid_domain_name(const char *domain);
  */
 int sss_rand(void);
 
-/* from nscd.c */
-errno_t sss_nscd_parse_conf(const char *conf_path);
-
 /* from sss_tc_utf8.c */
 char *
 sss_tc_utf8_str_tolower(TALLOC_CTX *mem_ctx, const char *s);

From 7f0f5a6ccbef843be3c246c84ad28f5c8ed06355 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 12:22:19 +0200
Subject: [PATCH 039/129] CONFDB: introduce helper to read a full list of
 configured services,
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

including implicitly configured

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/confdb/confdb.c   | 129 ++++++++++++++++++++++++++++++++++++++++++
 src/confdb/confdb.h   |  15 ++++-
 src/monitor/monitor.c | 124 ++--------------------------------------
 3 files changed, 147 insertions(+), 121 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index 252c557ce9a..a9b07436ae7 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -642,6 +642,135 @@ int confdb_get_string_as_list(struct confdb_ctx *cdb, TALLOC_CTX *ctx,
     return ret;
 }
 
+static errno_t add_implicit_services(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx,
+                                     char ***_services)
+{
+    int ret;
+    char **domain_names;
+    TALLOC_CTX *tmp_ctx;
+    size_t c;
+    char *conf_path;
+    char *id_provider;
+    bool add_pac = false;
+    bool implicit_pac_responder = true;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
+        return ENOMEM;
+    }
+
+    ret = confdb_get_enabled_domain_list(cdb, tmp_ctx, &domain_names);
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_OP_FAILURE, "No domains configured!\n");
+        goto done;
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE, "Error retrieving domains list [%d]: %s\n",
+              ret, sss_strerror(ret));
+        goto done;
+    }
+
+    ret = confdb_get_bool(cdb, CONFDB_MONITOR_CONF_ENTRY,
+                          CONFDB_MONITOR_IMPLICIT_PAC_RESPONDER, true,
+                          &implicit_pac_responder);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Failed to read implicit_pac_responder option, "
+              "using default 'true'.\n");
+        implicit_pac_responder = true;
+    }
+
+    for (c = 0; domain_names[c] != NULL; c++) {
+        if (!is_valid_domain_name(domain_names[c])) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Skipping invalid domain name '%s'\n", domain_names[c]);
+            continue;
+        }
+        conf_path = talloc_asprintf(tmp_ctx, CONFDB_DOMAIN_PATH_TMPL,
+                                    domain_names[c]);
+        if (conf_path == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
+            ret = ENOMEM;
+            goto done;
+        }
+
+        ret = confdb_get_string(cdb, tmp_ctx, conf_path,
+                                CONFDB_DOMAIN_ID_PROVIDER, NULL, &id_provider);
+        if (ret == EOK) {
+            if (id_provider == NULL) {
+                DEBUG(SSSDBG_OP_FAILURE, "id_provider is not set for "
+                      "domain [%s], trying next domain.\n", domain_names[c]);
+                continue;
+            }
+
+            if (strcasecmp(id_provider, "IPA") == 0
+                        || strcasecmp(id_provider, "AD") == 0) {
+                if (implicit_pac_responder) {
+                    add_pac = true;
+                } else {
+                    DEBUG(SSSDBG_CONF_SETTINGS,
+                          "PAC resonder not enabled for id provider [%s] "
+                          "because implicit_pac_responder is set to 'false'.\n",
+                          id_provider);
+                    add_pac = false;
+                }
+            }
+        } else {
+            DEBUG(SSSDBG_OP_FAILURE, "Failed to get id_provider for " \
+                                      "domain [%s], trying next domain.\n",
+                                      domain_names[c]);
+        }
+    }
+
+    if (BUILD_WITH_PAC_RESPONDER && add_pac &&
+        !string_in_list("pac", *_services, false)) {
+        ret = add_string_to_list(mem_ctx, "pac", _services);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "add_string_to_list failed.\n");
+            goto done;
+        }
+    }
+
+    ret = EOK;
+
+done:
+    talloc_free(tmp_ctx);
+
+    return ret;
+}
+
+int confdb_get_services_as_list(struct confdb_ctx *cdb, TALLOC_CTX *ctx,
+                                char ***_result)
+{
+    int ret;
+
+    ret = confdb_get_string_as_list(cdb, ctx,
+                                    CONFDB_MONITOR_CONF_ENTRY,
+                                    CONFDB_MONITOR_ACTIVE_SERVICES,
+                                    _result);
+#ifdef HAVE_SYSTEMD
+    if (ret != EOK && ret != ENOENT) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "Failed to get the explicitly configured services!\n");
+        return EINVAL;
+    }
+#else
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE, "No services configured!\n");
+        return EINVAL;
+    }
+#endif
+
+    /* `add_implicit_services()` can handle (*_result == NULL) */
+    ret = add_implicit_services(cdb, ctx, _result);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "Failed to add implicitly configured services\n");
+        return EINVAL;
+    }
+
+    return EOK;
+}
+
 int confdb_init(TALLOC_CTX *mem_ctx,
                 struct confdb_ctx **cdb_ctx,
                 const char *confdb_location)
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 7457a1214af..633e0bcbc3b 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -731,7 +731,7 @@ int confdb_set_string(struct confdb_ctx *cdb,
  * @param[in] attribute The name of the attribute to update
  * @param[out] result A pointer to the retrieved array of strings
  *
- * @return 0 - Successfully retrieved the entry (or used the default)
+ * @return 0 - Successfully retrieved the entry
  * @return ENOMEM - There was insufficient memory to complete the operation
  * @return EINVAL - The section could not be parsed, or the attribute was not
  *                  single-valued.
@@ -742,6 +742,19 @@ int confdb_get_string_as_list(struct confdb_ctx *cdb, TALLOC_CTX *ctx,
                               const char *section, const char *attribute,
                               char ***result);
 
+/**
+ * @brief Convenience function to retrieve a list of configured services,
+ * including implicitly configured, as a null-terminated array of strings.
+ *
+ * @param[in] cdb The connection object to the confdb
+ * @param[in] ctx The parent memory context for the returned string
+ * @param[out] _result A pointer to the retrieved array of strings
+ *
+ * @return 0 on success, error code otherwise
+ */
+int confdb_get_services_as_list(struct confdb_ctx *cdb, TALLOC_CTX *ctx,
+                                char ***_result);
+
 /**
  * @brief Convenience function to retrieve a list of subsections given a
  * configuration section name
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index f86574d24ae..a7d5801fb4d 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -669,103 +669,6 @@ static int check_domain_ranges(struct sss_domain_info *domains)
     return EOK;
 }
 
-static errno_t add_implicit_services(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx,
-                                     char ***_services)
-{
-    int ret;
-    char **domain_names;
-    TALLOC_CTX *tmp_ctx;
-    size_t c;
-    char *conf_path;
-    char *id_provider;
-    bool add_pac = false;
-    bool implicit_pac_responder = true;
-
-    tmp_ctx = talloc_new(NULL);
-    if (tmp_ctx == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
-        return ENOMEM;
-    }
-
-    ret = confdb_get_enabled_domain_list(cdb, tmp_ctx, &domain_names);
-    if (ret == ENOENT) {
-        DEBUG(SSSDBG_OP_FAILURE, "No domains configured!\n");
-        goto done;
-    } else if (ret != EOK) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "Error retrieving domains list [%d]: %s\n",
-              ret, sss_strerror(ret));
-        goto done;
-    }
-
-    ret = confdb_get_bool(cdb, CONFDB_MONITOR_CONF_ENTRY,
-                          CONFDB_MONITOR_IMPLICIT_PAC_RESPONDER, true,
-                          &implicit_pac_responder);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE,
-              "Failed to read implicit_pac_responder option, "
-              "using default 'true'.\n");
-        implicit_pac_responder = true;
-    }
-
-    for (c = 0; domain_names[c] != NULL; c++) {
-        if (!is_valid_domain_name(domain_names[c])) {
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "Skipping invalid domain name '%s'\n", domain_names[c]);
-            continue;
-        }
-        conf_path = talloc_asprintf(tmp_ctx, CONFDB_DOMAIN_PATH_TMPL,
-                                    domain_names[c]);
-        if (conf_path == NULL) {
-            DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
-            ret = ENOMEM;
-            goto done;
-        }
-
-        ret = confdb_get_string(cdb, tmp_ctx, conf_path,
-                                CONFDB_DOMAIN_ID_PROVIDER, NULL, &id_provider);
-        if (ret == EOK) {
-            if (id_provider == NULL) {
-                DEBUG(SSSDBG_OP_FAILURE, "id_provider is not set for "
-                      "domain [%s], trying next domain.\n", domain_names[c]);
-                continue;
-            }
-
-            if (strcasecmp(id_provider, "IPA") == 0
-                        || strcasecmp(id_provider, "AD") == 0) {
-                if (implicit_pac_responder) {
-                    add_pac = true;
-                } else {
-                    DEBUG(SSSDBG_CONF_SETTINGS,
-                          "PAC resonder not enabled for id provider [%s] "
-                          "because implicit_pac_responder is set to 'false'.\n",
-                          id_provider);
-                    add_pac = false;
-                }
-            }
-        } else {
-            DEBUG(SSSDBG_OP_FAILURE, "Failed to get id_provider for " \
-                                      "domain [%s], trying next domain.\n",
-                                      domain_names[c]);
-        }
-    }
-
-    if (BUILD_WITH_PAC_RESPONDER && add_pac &&
-        !string_in_list("pac", *_services, false)) {
-        ret = add_string_to_list(mem_ctx, "pac", _services);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, "add_string_to_list failed.\n");
-            goto done;
-        }
-    }
-
-    ret = EOK;
-
-done:
-    talloc_free(tmp_ctx);
-
-    return ret;
-}
-
 static char *check_service(char *service)
 {
     const char * const *known_services = get_known_services();
@@ -888,29 +791,10 @@ static int get_monitor_config(struct mt_ctx *ctx)
     char *badsrv = NULL;
     int i;
 
-    ret = confdb_get_string_as_list(ctx->cdb, ctx,
-                                    CONFDB_MONITOR_CONF_ENTRY,
-                                    CONFDB_MONITOR_ACTIVE_SERVICES,
-                                    &ctx->services);
-
-#ifdef HAVE_SYSTEMD
-    if (ret != EOK && ret != ENOENT) {
-        DEBUG(SSSDBG_FATAL_FAILURE,
-              "Failed to get the explicitly configured services!\n");
-        return EINVAL;
-    }
-#else
-    if (ret != EOK) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "No services configured!\n");
-        return EINVAL;
-    }
-#endif
-
-    ret = add_implicit_services(ctx->cdb, ctx, &ctx->services);
+    ret = confdb_get_services_as_list(ctx->cdb, ctx,
+                                      &ctx->services);
     if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, "Failed to add implicit configured "
-                                 "services. Some functionality might "
-                                 "be missing\n");
+        return ret;
     }
 
     badsrv = check_services(ctx->services);
@@ -1652,7 +1536,7 @@ static void monitor_sbus_connected(struct tevent_req *req)
          *  expires) */
         ret = add_services_startup_timeout(ctx);
     } else {
-        DEBUG(SSSDBG_FATAL_FAILURE, "No providers configured.");
+        DEBUG(SSSDBG_FATAL_FAILURE, "No providers configured.\n");
         ret = ERR_INVALID_CONFIG;
     }
 

From 28bb1467fe673fe7c09f75b29fe72dde836eb220 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 12:56:39 +0200
Subject: [PATCH 040/129] IFP: use new helper to retrieve services list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This still won't handle socket activated services, but should
take care of implicitly configured services at least.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/responder/ifp/ifp_components.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/responder/ifp/ifp_components.c b/src/responder/ifp/ifp_components.c
index c6b98374eae..0ee7ca24b7d 100644
--- a/src/responder/ifp/ifp_components.c
+++ b/src/responder/ifp/ifp_components.c
@@ -487,7 +487,6 @@ ifp_component_get_enabled(TALLOC_CTX *mem_ctx,
 {
     TALLOC_CTX *tmp_ctx;
     enum component_type type;
-    const char *param = NULL;
     char **values;
     char *name;
     errno_t ret;
@@ -513,15 +512,16 @@ ifp_component_get_enabled(TALLOC_CTX *mem_ctx,
         ret = EOK;
         goto done;
     case COMPONENT_RESPONDER:
-        param = CONFDB_MONITOR_ACTIVE_SERVICES;
+        ret = confdb_get_services_as_list(ctx->rctx->cdb, tmp_ctx, &values);
         break;
     case COMPONENT_BACKEND:
-        param = CONFDB_MONITOR_ACTIVE_DOMAINS;
+        ret = confdb_get_string_as_list(ctx->rctx->cdb, tmp_ctx,
+                                        CONFDB_MONITOR_CONF_ENTRY,
+                                        CONFDB_MONITOR_ACTIVE_DOMAINS,
+                                        &values);
         break;
     }
 
-    ret = confdb_get_string_as_list(ctx->rctx->cdb, tmp_ctx,
-                                    CONFDB_MONITOR_CONF_ENTRY, param, &values);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "Unable to retrieve configuration option"
               "[%d]: %s\n", ret, sss_strerror(ret));

From 59c48f7dfca6d1644fe35d0dbc474f8af3cdce19 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 13:12:54 +0200
Subject: [PATCH 041/129] socket_activated_responders: check confdb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(instead of sssd.conf) using new helper to take into
account implictly configured services.

Resolves: https://github.com/SSSD/sssd/issues/5013

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                                   |  1 +
 .../sssd_check_socket_activated_responders.c  | 49 +++----------------
 2 files changed, 7 insertions(+), 43 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index f13bc3799bf..839b25eae0e 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2004,6 +2004,7 @@ endif
 if HAVE_SYSTEMD_UNIT
 sssd_check_socket_activated_responders_SOURCES = \
     src/tools/sssd_check_socket_activated_responders.c \
+    src/tools/common/sss_tools.c \
     $(NULL)
 sssd_check_socket_activated_responders_CFLAGS = \
     $(AM_CFLAGS) \
diff --git a/src/tools/sssd_check_socket_activated_responders.c b/src/tools/sssd_check_socket_activated_responders.c
index dddc02ee24e..5753c2c6c21 100644
--- a/src/tools/sssd_check_socket_activated_responders.c
+++ b/src/tools/sssd_check_socket_activated_responders.c
@@ -24,73 +24,36 @@
 #include <stdio.h>
 
 #include "util/util.h"
-#include "util/sss_ini.h"
 #include "confdb/confdb.h"
+#include "common/sss_tools.h"
 
 static errno_t check_socket_activated_responder(const char *responder)
 {
     errno_t ret;
-    char *services = NULL;
-    const char *str;
     TALLOC_CTX *tmp_ctx;
-    struct sss_ini *init_data;
+    struct confdb_ctx *confdb;
+    char **services = NULL;
 
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) {
         return ENOMEM;
     }
 
-    init_data = sss_ini_new(tmp_ctx);
-    if (init_data == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
-
-    ret = sss_ini_read_sssd_conf(init_data,
-                                 SSSD_CONFIG_FILE,
-                                 CONFDB_DEFAULT_CONFIG_DIR);
+    ret = sss_tool_confdb_init(tmp_ctx, &confdb);
     if (ret != EOK) {
-        DEBUG(SSSDBG_DEFAULT,
-              "Failed to read configuration: [%d] [%s]. No reason to run "
-              "a responder if SSSD isn't configured.",
-              ret,
-              sss_strerror(ret));
         goto done;
     }
 
-    ret = sss_ini_get_cfgobj(init_data, "sssd", "services");
-
+    ret = confdb_get_services_as_list(confdb, tmp_ctx, &services);
     if (ret != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "sss_ini_get_cfgobj() failed [%d].\n", ret);
-        goto done;
-    }
-
-    ret = sss_ini_check_config_obj(init_data);
-    if (ret == ENOENT) {
-        /* In case there's no services' line at all, just return EOK. */
-        ret = EOK;
         goto done;
     }
 
-    services = sss_ini_get_string_config_value(init_data, &ret);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "sss_ini_get_string_config_value() failed [%d]\n",
-              ret);
-        goto done;
-    }
-
-    str = strstr(services, responder);
-    if (str != NULL) {
+    if (string_in_list(responder, services, false)) {
         ret = EEXIST;
-        goto done;
     }
 
-    ret = EOK;
-
 done:
-    free(services);
     talloc_free(tmp_ctx);
 
     return ret;

From 32e7616e2cfa879345a49f1e3242cac08e3d0178 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 13:36:51 +0200
Subject: [PATCH 042/129] socket_activated_responders: log to syslog instead of
 stdout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise logs of 'ExecStartPre' command are lost.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/tools/sssd_check_socket_activated_responders.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/tools/sssd_check_socket_activated_responders.c b/src/tools/sssd_check_socket_activated_responders.c
index 5753c2c6c21..a31c43491ef 100644
--- a/src/tools/sssd_check_socket_activated_responders.c
+++ b/src/tools/sssd_check_socket_activated_responders.c
@@ -93,14 +93,13 @@ int main(int argc, const char *argv[])
 
     ret = check_socket_activated_responder(responder);
     if (ret != EOK) {
-        DEBUG(SSSDBG_DEFAULT,
-              "Misconfiguration found for the %s responder.\n"
-              "The %s responder has been configured to be socket-activated "
-              "but it's still mentioned in the services' line in %s.\n"
-              "Please, consider either adjusting your services' line in %s "
-              "or disabling the %s's socket by calling:\n"
+        sss_log(SSS_LOG_ERR,
+              "Misconfiguration found for the '%s' responder.\n"
+              "It has been configured to be socket-activated but "
+              "it's still mentioned in the services' line of the config file.\n"
+              "Please consider either adjusting services' line "
+              "or disabling the socket by calling:\n"
               "\"systemctl disable sssd-%s.socket\"",
-              responder, responder, SSSD_CONFIG_FILE, SSSD_CONFIG_FILE,
               responder, responder);
         goto done;
     }

From 272ee81b7304da37095a9727b062d124bf0fbbc0 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 17:16:43 +0200
Subject: [PATCH 043/129] TESTS:INTG: 'implicit files domain' not supported
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

since 501e05f46252ba6e097983a871c92b3896b596f2

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/tests/intg/test_files_provider.py | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py
index c318d733cda..ba33e83b692 100644
--- a/src/tests/intg/test_files_provider.py
+++ b/src/tests/intg/test_files_provider.py
@@ -1216,18 +1216,6 @@ def test_realloc_groups(setup_gr_with_canary, files_domain_only):
     realloc_groups(setup_gr_with_canary, FILES_REALLOC_CHUNK * 3)
 
 
-# Files domain autoconfiguration tests
-@pytest.mark.skipif(not have_files_provider(),
-                    reason="'files provider' disabled, skipping")
-def test_no_sssd_domain(add_user_with_canary, no_sssd_domain):
-    """
-    Test that if no sssd domain is configured, sssd will add the implicit one
-    """
-    res, user = sssd_getpwnam_sync(USER1["name"])
-    assert res == NssReturnCode.SUCCESS
-    assert user == USER1
-
-
 @pytest.mark.skipif(not have_files_provider(),
                     reason="'files provider' disabled, skipping")
 def test_proxy_to_files_domain_only(add_user_with_canary,
@@ -1239,17 +1227,6 @@ def test_proxy_to_files_domain_only(add_user_with_canary,
     assert res == NssReturnCode.NOTFOUND
 
 
-@pytest.mark.skipif(not have_files_provider(),
-                    reason="'files provider' disabled, skipping")
-def test_no_files_domain(add_user_with_canary, no_files_domain):
-    """
-    Test that if no files domain is configured, sssd will add the implicit one
-    """
-    res, user = sssd_getpwnam_sync(USER1["name"])
-    assert res == NssReturnCode.SUCCESS
-    assert user == USER1
-
-
 @pytest.mark.skipif(not have_files_provider(),
                     reason="'files provider' disabled, skipping")
 def test_disable_files_domain(add_user_with_canary, disabled_files_domain):

From dbf47635513fb5ac7fc398c065506e740929ad19 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 9 Oct 2024 20:01:32 +0200
Subject: [PATCH 044/129] CONFDB: don't hard fail in add_implicit_services()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

if no explicitly configured domains found.

There are might be 'enable_files_domain = true' or app domains that
are expanded later.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/confdb/confdb.c   | 3 ++-
 src/monitor/monitor.c | 6 +++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index a9b07436ae7..7515da45d05 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -662,7 +662,8 @@ static errno_t add_implicit_services(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx
 
     ret = confdb_get_enabled_domain_list(cdb, tmp_ctx, &domain_names);
     if (ret == ENOENT) {
-        DEBUG(SSSDBG_OP_FAILURE, "No domains configured!\n");
+        /* confdb_expand_app_domains() wasn't called yet, so this might be ok */
+        ret = EOK;
         goto done;
     } else if (ret != EOK) {
         DEBUG(SSSDBG_FATAL_FAILURE, "Error retrieving domains list [%d]: %s\n",
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index a7d5801fb4d..e17b0e4169c 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -2016,7 +2016,11 @@ int main(int argc, const char *argv[])
     }
 
     monitor->cdb = main_ctx->confdb_ctx;
-    get_monitor_config(monitor);
+    ret = get_monitor_config(monitor);
+    if (ret != EOK) {
+        ret = 1;
+        goto out;
+    }
     monitor->is_daemon = !opt_interactive;
     monitor->parent_pid = main_ctx->parent_pid;
     monitor->ev = main_ctx->event_ctx;

From 9bb7b920121a014bc4815e2b4d4a96bb628f0235 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 11 Oct 2024 11:45:44 +0200
Subject: [PATCH 045/129] CONFDB: mistype fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/confdb/confdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index 7515da45d05..593400ac264 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -710,7 +710,7 @@ static errno_t add_implicit_services(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx
                     add_pac = true;
                 } else {
                     DEBUG(SSSDBG_CONF_SETTINGS,
-                          "PAC resonder not enabled for id provider [%s] "
+                          "PAC responder not enabled for id provider [%s] "
                           "because implicit_pac_responder is set to 'false'.\n",
                           id_provider);
                     add_pac = false;

From c265745f44b21972fc9754e31d765c73d07da4a8 Mon Sep 17 00:00:00 2001
From: Weblate <noreply@weblate.org>
Date: Mon, 2 Sep 2024 13:38:32 +0200
Subject: [PATCH 046/129] po: update translations

(Swedish) currently translated at 100.0% (2790 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/

po: update translations

(Czech) currently translated at 6.3% (177 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/cs/

po: update translations

(French) currently translated at 100.0% (748 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fr/

po: update translations

(Swedish) currently translated at 99.5% (2777 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/

po: update translations

(Swedish) currently translated at 99.5% (2777 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/

po: update translations

(Swedish) currently translated at 99.4% (2775 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/

po: update translations

(Swedish) currently translated at 99.4% (2775 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/

po: update translations

(Swedish) currently translated at 99.0% (2764 of 2790 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/

po: update translations

(Swedish) currently translated at 100.0% (748 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/sv/

po: update translations

(Swedish) currently translated at 94.5% (707 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/sv/

po: update translations

(Swedish) currently translated at 94.5% (707 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/sv/

po: update translations

(French) currently translated at 93.7% (701 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fr/

po: update translations

(Russian) currently translated at 100.0% (2792 of 2792 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ru/

po: update translations

(Russian) currently translated at 100.0% (2792 of 2792 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ru/

po: update translations

(Spanish) currently translated at 82.3% (616 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/es/

po: update translations

(Ukrainian) currently translated at 100.0% (2792 of 2792 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/uk/

po: update translations

(Ukrainian) currently translated at 100.0% (748 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/uk/

po: update translations

(Russian) currently translated at 100.0% (748 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ru/

po: update translations

(French) currently translated at 93.1% (697 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fr/

Update translation files

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/

po: update translations

(Turkish) currently translated at 100.0% (748 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/tr/

po: update translations

(Czech) currently translated at 93.4% (699 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/

po: update translations

(Russian) currently translated at 100.0% (2789 of 2789 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ru/

po: update translations

(Russian) currently translated at 100.0% (748 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ru/

po: update translations

(Czech) currently translated at 92.9% (695 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/

po: update translations

(Czech) currently translated at 91.9% (688 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/

po: update translations

(Georgian) currently translated at 14.0% (105 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ka/

po: update translations

(Georgian) currently translated at 13.7% (103 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ka/

po: update translations

(Georgian) currently translated at 13.7% (103 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ka/

po: update translations

(Czech) currently translated at 91.7% (686 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/

po: update translations

(Korean) currently translated at 94.7% (709 of 748 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ko/

po: update translations

(Ukrainian) currently translated at 100.0% (2789 of 2789 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/uk/

po: update translations

(Korean) currently translated at 66.6% (1712 of 2569 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/

po: update translations

(Ukrainian) currently translated at 99.8% (2784 of 2789 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/uk/

po: update translations

(Korean) currently translated at 66.4% (1712 of 2577 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
---
 po/es.po         |   37 +-
 po/fr.po         |  181 +++---
 po/ru.po         |    4 +-
 po/sv.po         |  135 +++--
 po/tr.po         |  142 +++--
 po/uk.po         |  150 ++---
 src/man/po/cs.po |   56 +-
 src/man/po/ru.po | 1514 ++++++++++++++++++++++++----------------------
 src/man/po/sv.po |  349 ++++-------
 src/man/po/uk.po | 1497 +++++++++++++++++++++++----------------------
 10 files changed, 2076 insertions(+), 1989 deletions(-)

diff --git a/po/es.po b/po/es.po
index 84e2dfc8ab2..3e9bb51436a 100644
--- a/po/es.po
+++ b/po/es.po
@@ -12,14 +12,14 @@
 # sgallagh <sgallagh@redhat.com>, 2011
 # sgallagh <sgallagh@redhat.com>, 2011
 # vareli <ehespinosa@ya.com>, 2013
-# Emilio Herrera <ehespinosa57@gmail.com>, 2018. #zanata, 2021, 2022.
-# Emilio Herrera <ehespinosa57@gmail.com>, 2019. #zanata, 2021, 2022.
+# Emilio Herrera <ehespinosa57@gmail.com>, 2018. #zanata, 2021, 2022, 2024.
+# Emilio Herrera <ehespinosa57@gmail.com>, 2019. #zanata, 2021, 2022, 2024.
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
 "POT-Creation-Date: 2024-06-25 13:26+0200\n"
-"PO-Revision-Date: 2022-09-11 10:19+0000\n"
+"PO-Revision-Date: 2024-07-01 16:36+0000\n"
 "Last-Translator: Emilio Herrera <ehespinosa57@gmail.com>\n"
 "Language-Team: Spanish <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-master/es/>\n"
@@ -28,7 +28,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 4.14\n"
+"X-Generator: Weblate 5.6.2\n"
 
 #: src/config/SSSDConfig/sssdoptions.py:20
 #: src/config/SSSDConfig/sssdoptions.py:21
@@ -178,11 +178,11 @@ msgstr ""
 #: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
+"Habilita o deshabilita los volcados del núcleo para todos los procesos SSSD."
 
 #: src/config/SSSDConfig/sssdoptions.py:56
-#, fuzzy
 msgid "Tune passkey verification behavior"
-msgstr "Ajustar la verificación del cetificado"
+msgstr "Ajustar la verificación del certificado"
 
 #: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Enumeration cache timeout length (seconds)"
@@ -422,18 +422,16 @@ msgstr ""
 "cumplir para el acceso PAM con autenticación GSSAPI"
 
 #: src/config/SSSDConfig/sssdoptions.py:115
-#, fuzzy
 msgid "Allow passkey device authentication."
-msgstr "Permitir el certificado basado/en autenticación Smartcard."
+msgstr "Permitir la autentificación del dispositivo con clave de acceso."
 
 #: src/config/SSSDConfig/sssdoptions.py:116
-#, fuzzy
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
-msgstr "Cuantos segundos esperará pam_sss a que termine p11_child"
+msgstr "Cuantos segundos esperará pam_sss a que termine passkey_child"
 
 #: src/config/SSSDConfig/sssdoptions.py:117
 msgid "Enable debugging in the libfido2 library"
-msgstr ""
+msgstr "Habilitar la depuración en la librería libfido2"
 
 #: src/config/SSSDConfig/sssdoptions.py:120
 msgid "Whether to evaluate the time-based attributes in sudo rules"
@@ -672,6 +670,9 @@ msgid ""
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
+"Especifica el intervalo, en segundos, que SSSD espera antes de intentar "
+"volver a conector con el servidor principal después de una conexión con "
+"éxito al servidor de respaldo"
 
 #: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Override GID value from the identity provider with this value"
@@ -690,6 +691,8 @@ msgstr ""
 #: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
+"Desviación máxima del período al actualizar entradas caducadas en segundo "
+"plano"
 
 #: src/config/SSSDConfig/sssdoptions.py:200
 msgid "Whether to automatically update the client's DNS entry"
@@ -713,10 +716,8 @@ msgstr ""
 "Frecuencia con la que actualizar periódicamente la entrada del cliente DNS"
 
 #: src/config/SSSDConfig/sssdoptions.py:204
-#, fuzzy
 msgid "Maximum period deviation when updating the client's DNS entry"
-msgstr ""
-"Frecuencia con la que actualizar periódicamente la entrada del cliente DNS"
+msgstr "Desviación máxima del período al actualizar la entrada DNS del cliente"
 
 #: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the provider should explicitly update the PTR record as well"
@@ -749,6 +750,7 @@ msgstr "Frecuencia con la que la lista de subdominios es refrescada"
 #: src/config/SSSDConfig/sssdoptions.py:211
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
+"Desviación máxima del período cuando se refresca la lista de subdominios"
 
 #: src/config/SSSDConfig/sssdoptions.py:212
 msgid "List of options that should be inherited into a subdomain"
@@ -807,7 +809,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:226
 msgid "Local authentication methods policy "
-msgstr ""
+msgstr "Métodos de política de autenticación local "
 
 #: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA domain"
@@ -1455,7 +1457,7 @@ msgstr "Deshabilitar el rango de recuperación Active Directory"
 
 #: src/config/SSSDConfig/sssdoptions.py:400
 msgid "Use the ppolicy extension"
-msgstr ""
+msgstr "Utilizar la extensión ppolicy"
 
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
@@ -1470,9 +1472,8 @@ msgid "Length of time between enumeration updates"
 msgstr "Tiempo en segundos entre las actualizaciones de enumeración"
 
 #: src/config/SSSDConfig/sssdoptions.py:406
-#, fuzzy
 msgid "Maximum period deviation between enumeration updates"
-msgstr "Tiempo en segundos entre las actualizaciones de enumeración"
+msgstr "Desviación máxima del período entre las actualizaciones de enumeración"
 
 #: src/config/SSSDConfig/sssdoptions.py:407
 msgid "Length of time between cache cleanups"
diff --git a/po/fr.po b/po/fr.po
index 110ff8a32f6..251f9c0578d 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -14,13 +14,14 @@
 # Sundeep Anand <suanand@redhat.com>, 2021.
 # Transtats <suanand@redhat.com>, 2022.
 # grimst <grimaitres@gmail.com>, 2023.
+# Léane GRASSER <leane.grasser@proton.me>, 2024.
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
 "POT-Creation-Date: 2024-06-25 13:26+0200\n"
-"PO-Revision-Date: 2023-06-10 12:20+0000\n"
-"Last-Translator: Ludek Janda <ljanda@redhat.com>\n"
+"PO-Revision-Date: 2024-09-02 11:38+0000\n"
+"Last-Translator: Léane GRASSER <leane.grasser@proton.me>\n"
 "Language-Team: French <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-master/fr/>\n"
 "Language: fr\n"
@@ -28,7 +29,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n > 1;\n"
-"X-Generator: Weblate 4.17\n"
+"X-Generator: Weblate 5.7.1\n"
 
 #: src/config/SSSDConfig/sssdoptions.py:20
 #: src/config/SSSDConfig/sssdoptions.py:21
@@ -673,6 +674,9 @@ msgid ""
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
+"Spécifie l'intervalle, en secondes, pendant lequel SSSD attend avant "
+"d'essayer de se reconnecter au serveur principal après une connexion réussie "
+"au serveur de secours"
 
 #: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Override GID value from the identity provider with this value"
@@ -768,8 +772,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Whether to automatically create private groups for users"
-msgstr ""
-"S'il faut créer automatiquement des groupes privés pour les utilisateurs"
+msgstr "Créer automatiquement un groupe privé pour chacun des utilisateurs"
 
 #: src/config/SSSDConfig/sssdoptions.py:216
 msgid "Display a warning N days before the password expires."
@@ -812,7 +815,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:226
 msgid "Local authentication methods policy "
-msgstr ""
+msgstr "Politique des méthodes d'authentification locale "
 
 #: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA domain"
@@ -1106,45 +1109,44 @@ msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
-"Durée entre les recherches de fichiers de politiques de GPO dans le serveur "
-"AD"
+"Durée entre les recherches de fichiers de stratégie GPO dans le serveur AD"
 
 #: src/config/SSSDConfig/sssdoptions.py:305
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
-"Noms de services PAM correspondant à la configuration de la politique "
-"(Deny)InteractiveLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
+"InteractiveLogonRight de la GPO"
 
 #: src/config/SSSDConfig/sssdoptions.py:307
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
-"Noms de services PAM correspondant à la configuration de la politique "
-"(Deny)RemoteInteractiveLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
+"RemoteInteractiveLogonRight de la GPO"
 
 #: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
-"Noms de services PAM correspondant à la configuration de la politique "
-"(Deny)NetworkLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
+"NetworkLogonRight de la GPO"
 
 #: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
-"Noms de services PAM correspondant à la configuration de la politique "
-"(Deny)BatchLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
+"BatchLogonRight de la GPO"
 
 #: src/config/SSSDConfig/sssdoptions.py:311
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
-"Noms de services PAM correspondant à la configuration de la politique "
-"(Deny)ServiceLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
+"ServiceLogonRight de la GPO"
 
 #: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always granted"
@@ -1463,7 +1465,7 @@ msgstr "Désactiver la récupération de plage Active Directory"
 
 #: src/config/SSSDConfig/sssdoptions.py:400
 msgid "Use the ppolicy extension"
-msgstr ""
+msgstr "Utiliser l'extension ppolicy"
 
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
@@ -1813,7 +1815,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:493
 msgid "DN for ppolicy queries"
-msgstr "DN pour les requêtes sur ppolicy"
+msgstr "DN pour les requêtes ppolicy"
 
 #: src/config/SSSDConfig/sssdoptions.py:494
 msgid "How many maximum entries to fetch during a wildcard request"
@@ -2078,18 +2080,19 @@ msgid "Path of group file sources."
 msgstr "Chemin des sources des fichiers de groupe."
 
 #: src/monitor/monitor.c:819
-#, fuzzy
 msgid "Config operation failed\n"
-msgstr "L'opération d'indexation a échoué : %1$s\n"
+msgstr "Échec de l'opération de configuration\n"
 
 #: src/monitor/monitor.c:830
 msgid "'"
-msgstr ""
+msgstr "L'option de configuration '"
 
 #: src/monitor/monitor.c:845
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
+"Valeur '%s' non prise en charge pour l'option de configuration '%s'. "
+"Utilisez uniquement 'root' ou '"
 
 #: src/monitor/monitor.c:1975
 msgid "Become a daemon (default)"
@@ -2104,12 +2107,15 @@ msgid "Print version number and exit"
 msgstr "Afficher le numéro de version et quitte"
 
 #: src/monitor/monitor.c:1990
-#, fuzzy, c-format
+#, c-format
 msgid ""
 "\n"
 "Invalid option %s: %s\n"
 "\n"
-msgstr "L'opération d'indexation a échoué : %1$s\n"
+msgstr ""
+"\n"
+"Option %s invalide : %s\n"
+"\n"
 
 #: src/monitor/monitor.c:2012
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
@@ -2117,21 +2123,23 @@ msgstr "Option -i|--interactive non authorisée avec -D|--daemon\n"
 
 #: src/monitor/monitor.c:2054
 msgid "Failed to get initial capabilities\n"
-msgstr ""
+msgstr "Échec de l'obtention des capacités initiales\n"
 
 #: src/monitor/monitor.c:2065
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
+"Le programme n'a pas été compilé avec la prise en charge de l'utilisateur de "
+"service non root. Impossible de s'exécuter en tant que %"
 
 #: src/monitor/monitor.c:2082
 #, c-format
 msgid "Can't read config: '%s'\n"
-msgstr ""
+msgstr "Impossible de lire la configuration : '%s'\n"
 
 #: src/monitor/monitor.c:2101
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
-msgstr ""
+msgstr "Échec du démarrage du processus SSSD 'monitor' : %s"
 
 #: src/monitor/monitor.c:2194
 msgid "Out of memory\n"
@@ -2206,19 +2214,16 @@ msgid "Domain of the information provider (mandatory)"
 msgstr "Domaine du fournisseur d'informations (obligatoire)"
 
 #: src/sss_client/common.c:1164
-#, fuzzy
 msgid "Socket has wrong ownership or permissions."
-msgstr ""
-"Le socket public a de mauvaises permissions ou un mauvais propriétaire."
+msgstr "Les autorisations d'accès ou le propriétaire du socket est incorrect."
 
 #: src/sss_client/common.c:1167
 msgid "Unexpected format of the server credential message."
 msgstr "Le message du serveur de crédits a un format inattendu."
 
 #: src/sss_client/common.c:1170
-#, fuzzy
 msgid "SSSD is not run by trusted user."
-msgstr "SSSD n'est pas démarré par root."
+msgstr "SSSD n'est pas exécuté par un utilisateur de confiance."
 
 #: src/sss_client/common.c:1173
 msgid "SSSD socket does not exist."
@@ -2250,6 +2255,8 @@ msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
+"Le TGT Kerberos ne sera pas accordé lors de la connexion ; cela affectera "
+"l'expérience utilisateur."
 
 #: src/sss_client/pam_sss.c:72
 msgid "Enter PIN:"
@@ -2314,6 +2321,8 @@ msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
+"Aucun TGT Kerberos accordé car le serveur ne prend pas en charge cette "
+"méthode. Cela affectera votre expérience d'authentification unique (SSO)."
 
 #: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
 msgid "Password change failed. "
@@ -2409,6 +2418,15 @@ msgid ""
 "******************************************************************************\n"
 "\n"
 msgstr ""
+"\n"
+"*****************************************************************************"
+"*\n"
+"Votre système est configuré de manière à utiliser l'outil obsolète\n"
+"sss_ssh_knownhostsproxy.\n"
+"Lisez la page man sss_ssh_knownhosts(1) pour découvrir son remplaçant.\n"
+"*****************************************************************************"
+"*\n"
+"\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
 msgid "The port to use to connect to the host"
@@ -2715,26 +2733,24 @@ msgid "Check mapping and matching rule with a certificate"
 msgstr "Vérifier le mappage et la règle de correspondance avec un certificat"
 
 #: src/tools/sssctl/sssctl.c:343
-#, fuzzy
 msgid "GPOs related tools:"
-msgstr "Outils liés à la clé d’accès :"
+msgstr "Outils liés aux GPO :"
 
 #: src/tools/sssctl/sssctl.c:344
-#, fuzzy
 msgid "Information about cached GPO"
-msgstr "Informations sur l'utilisateur en cache"
+msgstr "Informations sur une GPO en cache"
 
 #: src/tools/sssctl/sssctl.c:345
 msgid "Enumerate cached GPOs"
-msgstr ""
+msgstr "Énumérer les GPO en cache"
 
 #: src/tools/sssctl/sssctl.c:346
 msgid "Remove cached GPO"
-msgstr ""
+msgstr "Supprimer une GPO du cache"
 
 #: src/tools/sssctl/sssctl.c:347
 msgid "Remove all cached GPOs"
-msgstr ""
+msgstr "Supprimer toutes les GPO du cache"
 
 #: src/tools/sssctl/sssctl.c:349
 msgid "Passkey related tools:"
@@ -2770,25 +2786,24 @@ msgid "Cached in InfoPipe"
 msgstr "Mise en cache dans InfoPipe"
 
 #: src/tools/sssctl/sssctl_cache.c:38
-#, fuzzy
 msgid "Policy Name"
-msgstr "Nom complet"
+msgstr "Nom de la stratégie"
 
 #: src/tools/sssctl/sssctl_cache.c:39
 msgid "Policy GUID"
-msgstr ""
+msgstr "GUID de la stratégie"
 
 #: src/tools/sssctl/sssctl_cache.c:40
 msgid "Policy Path"
-msgstr ""
+msgstr "Chemin d'accès à la stratégie"
 
 #: src/tools/sssctl/sssctl_cache.c:41
 msgid "Policy file timeout"
-msgstr ""
+msgstr "Durée d'expiration du fichier de stratégie"
 
 #: src/tools/sssctl/sssctl_cache.c:42
 msgid "Policy version"
-msgstr ""
+msgstr "Version de la stratégie"
 
 #: src/tools/sssctl/sssctl_cache.c:566
 #, c-format
@@ -2802,7 +2817,7 @@ msgstr "%s : Impossible de lire la valeur [%d] : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:612
 msgid "Specify name."
-msgstr "Spécifier un nom."
+msgstr "Spécifiez un nom."
 
 #: src/tools/sssctl/sssctl_cache.c:622
 #, c-format
@@ -2826,24 +2841,23 @@ msgid "Search by group ID"
 msgstr "Rechercher par ID de groupe"
 
 #: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
-#, fuzzy
 msgid "Search by GPO guid"
-msgstr "Rechercher par ID de groupe"
+msgstr "Recherche par GUID de GPO"
 
 #: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to parse command line: %s\n"
-msgstr "Impossible d’analyser les arguments de la commande\n"
+msgstr "Impossible d'analyser la ligne de commande : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
 #, c-format
 msgid "%s\n"
-msgstr ""
+msgstr "%s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:817
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to print object: %s\n"
-msgstr "N’a pas pu ouvrir %s\n"
+msgstr "Impossible d'afficher l'objet : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
 #: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
@@ -2851,44 +2865,40 @@ msgstr "N’a pas pu ouvrir %s\n"
 #: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
 #: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
 #: src/tools/sssctl/sssctl_cache.c:1261
-#, fuzzy
 msgid "talloc failed\n"
-msgstr "malloc a échoué.\n"
+msgstr "talloc échoué\n"
 
 #: src/tools/sssctl/sssctl_cache.c:855
-#, fuzzy
 msgid "Unable to get attribute list!\n"
-msgstr "Impossible d'obtenir la liste des serveurs\n"
+msgstr "Impossible d'obtenir la liste d'attributs\n"
 
 #: src/tools/sssctl/sssctl_cache.c:862
-#, fuzzy
 msgid "Unable to create filter\n"
-msgstr "Impossible de supprimer les fichiers de cache\n"
+msgstr "Impossible de créer le filtre\n"
 
 #: src/tools/sssctl/sssctl_cache.c:875
 #, c-format
 msgid "%s [%s]:\n"
-msgstr ""
+msgstr "%s [%s] :\n"
 
 #: src/tools/sssctl/sssctl_cache.c:880
-#, fuzzy
 msgid "Unable to get GPOs base DN\n"
-msgstr "Impossible d'obtenir la liste des serveurs\n"
+msgstr "Impossible d'obtenir le DN de base des GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:890
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to search sysdb: %s\n"
-msgstr "Impossible d'archiver les fichiers journaux\n"
+msgstr "Impossible de rechercher dans la sysdb : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:896
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
-msgstr "Impossible de se connecter au bus système !\n"
+msgstr "Impossible de convertir le message en attributs sysdb : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:945
 #, c-format
 msgid "\t%s: %s\n"
-msgstr ""
+msgstr "\t%s : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
 msgid "\n"
@@ -2896,15 +2906,15 @@ msgstr "\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1031
 msgid "Could not find GUID attribute from GPO entry\n"
-msgstr ""
+msgstr "Impossible de trouver l'attribut GUID dans l'entrée GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1038
 msgid "Could not find description attribute from GPO entry\n"
-msgstr ""
+msgstr "Impossible de trouver l'attribut description dans l'entrée GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1062
 msgid "Could not delete GPO entry from cache\n"
-msgstr ""
+msgstr "Impossible de supprimer l'entrée GPO du cache\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1068
 #, c-format
@@ -2912,45 +2922,46 @@ msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
+"Le chemin d'accès à la GPO n'était pas encore stocké en cache. Veuillez "
+"supprimer manuellement les fichiers depuis le répertoire [%s]\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
-msgstr ""
+msgstr "Impossible de déterminer le chemin d'accès réel pour [%s] : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1088
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
-msgstr ""
+msgstr "Le chemin d'accès à la GPO en cache [%s] n'est pas sous [%s], ignoré.\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1113
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
-msgstr "Impossible de supprimer les fichiers journaux\n"
+msgstr "Impossible de supprimer les fichiers GPO téléchargés : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1181
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to fetch cache entry: %s\n"
-msgstr "N’a pas pu ouvrir %s\n"
+msgstr "Échec de l'ouverture de l'entrée dans le cache : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1186
-#, fuzzy
 msgid "Could not determine object domain\n"
-msgstr "Impossible d'ouvrir aucun des domaines disponibles\n"
+msgstr "Impossible de déterminer le domaine de l'objet\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1216
 msgid "Could not find GUID attribute in GPO entry\n"
-msgstr ""
+msgstr "Impossible de trouver l'attribut GUID dans l'entrée GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1222
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to delete GPO: %s\n"
-msgstr "N’a pas pu ouvrir %s\n"
+msgstr "Impossible de supprimer la GPO : %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1226
 #, c-format
 msgid "%s removed from cache\n"
-msgstr ""
+msgstr "%s supprimé du cache\n"
 
 #: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
 #: src/tools/sssctl/sssctl_cert.c:217
@@ -3055,9 +3066,9 @@ msgid "There is no configuration.\n"
 msgstr "Il n'y a pas de configuration.\n"
 
 #: src/tools/sssctl/sssctl_config.c:121
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to read '%s': %s\n"
-msgstr "N’a pas pu ouvrir %s\n"
+msgstr "Échec de la lecture de '%s' : %s\n"
 
 #: src/tools/sssctl/sssctl_config.c:130
 msgid "Failed to run validators"
diff --git a/po/ru.po b/po/ru.po
index 13b9e38902f..8fc611d8479 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -13,7 +13,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
 "POT-Creation-Date: 2024-06-25 13:26+0200\n"
-"PO-Revision-Date: 2024-06-21 14:36+0000\n"
+"PO-Revision-Date: 2024-06-27 05:36+0000\n"
 "Last-Translator: Elena Mishina <lepata@basealt.ru>\n"
 "Language-Team: Russian <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-master/ru/>\n"
@@ -700,7 +700,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:200
 msgid "Whether to automatically update the client's DNS entry"
-msgstr "Следует ли автоматически обновлять запись DNS клиента"
+msgstr "Определяет, следует ли автоматически обновлять запись DNS клиента"
 
 #: src/config/SSSDConfig/sssdoptions.py:201
 #: src/config/SSSDConfig/sssdoptions.py:234
diff --git a/po/sv.po b/po/sv.po
index 417ab9b7ac0..b422b042963 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -9,12 +9,13 @@
 # Göran Uddeborg <goeran@uddeborg.se>, 2019. #zanata, 2020, 2021, 2022, 2023, 2024.
 # Anders Jonsson <anders.jonsson@norsjovallen.se>, 2020. #zanata
 # Luna Jernberg <bittin@reimu.nl>, 2022.
+# Weblate Translation Memory <noreply-mt-weblate-translation-memory@weblate.org>, 2024.
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
 "POT-Creation-Date: 2024-06-25 13:26+0200\n"
-"PO-Revision-Date: 2024-03-05 18:36+0000\n"
+"PO-Revision-Date: 2024-08-29 20:38+0000\n"
 "Last-Translator: Göran Uddeborg <goeran@uddeborg.se>\n"
 "Language-Team: Swedish <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-master/sv/>\n"
@@ -23,7 +24,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.4\n"
+"X-Generator: Weblate 5.7\n"
 
 #: src/config/SSSDConfig/sssdoptions.py:20
 #: src/config/SSSDConfig/sssdoptions.py:21
@@ -636,6 +637,8 @@ msgid ""
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
+"Anger intervallet, i sekunder, som SSSD väntar före den försöker återansluta "
+"till primärservern efter en lyckad anslutning till reservservern"
 
 #: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Override GID value from the identity provider with this value"
@@ -1379,7 +1382,7 @@ msgstr "Avaktivera Active Directorys intervallhämtande"
 
 #: src/config/SSSDConfig/sssdoptions.py:400
 msgid "Use the ppolicy extension"
-msgstr ""
+msgstr "Använd utökningen ppolicy"
 
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
@@ -1980,18 +1983,18 @@ msgid "Path of group file sources."
 msgstr "Sökväg till gruppfilkällor."
 
 #: src/monitor/monitor.c:819
-#, fuzzy
 msgid "Config operation failed\n"
-msgstr "Indexåtgärden misslyckades: %1$s\n"
+msgstr "Konfigurationsåtgärden misslyckades\n"
 
 #: src/monitor/monitor.c:830
 msgid "'"
-msgstr ""
+msgstr "”"
 
 #: src/monitor/monitor.c:845
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
+"Ej stött värde ”%s” på konfigurationsalternativet ”%s”! Endast ”root” eller ”"
 
 #: src/monitor/monitor.c:1975
 msgid "Become a daemon (default)"
@@ -2006,12 +2009,15 @@ msgid "Print version number and exit"
 msgstr "Skriv ut versionsnumret och avsluta"
 
 #: src/monitor/monitor.c:1990
-#, fuzzy, c-format
+#, c-format
 msgid ""
 "\n"
 "Invalid option %s: %s\n"
 "\n"
-msgstr "Indexåtgärden misslyckades: %1$s\n"
+msgstr ""
+"\n"
+"Felaktig flagga %s: %s\n"
+"\n"
 
 #: src/monitor/monitor.c:2012
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
@@ -2020,21 +2026,22 @@ msgstr ""
 
 #: src/monitor/monitor.c:2054
 msgid "Failed to get initial capabilities\n"
-msgstr ""
+msgstr "Misslyckades att hämta initiala förmågor\n"
 
 #: src/monitor/monitor.c:2065
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
+"Stöd för icke-root-tjänsteanvändare är inte byggt. Kan inte köra under %"
 
 #: src/monitor/monitor.c:2082
 #, c-format
 msgid "Can't read config: '%s'\n"
-msgstr ""
+msgstr "Kan inte läsa konfigurationen: ”%s”\n"
 
 #: src/monitor/monitor.c:2101
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
-msgstr ""
+msgstr "Misslyckades att starta upp SSSD:s process ”monitor”: %s"
 
 #: src/monitor/monitor.c:2194
 msgid "Out of memory\n"
@@ -2109,18 +2116,16 @@ msgid "Domain of the information provider (mandatory)"
 msgstr "Domän för informationsleverantören (obligatoriskt)"
 
 #: src/sss_client/common.c:1164
-#, fuzzy
 msgid "Socket has wrong ownership or permissions."
-msgstr "Publikt uttag (socket) har fel ägarskap eller rättigheter."
+msgstr "Uttaget (socket) har fel ägare eller rättigheter."
 
 #: src/sss_client/common.c:1167
 msgid "Unexpected format of the server credential message."
 msgstr "Oväntat format på serverns kreditivmeddelande."
 
 #: src/sss_client/common.c:1170
-#, fuzzy
 msgid "SSSD is not run by trusted user."
-msgstr "SSSD körs inte av root."
+msgstr "SSSD körs inte av en betrodd användare."
 
 #: src/sss_client/common.c:1173
 msgid "SSSD socket does not exist."
@@ -2312,6 +2317,16 @@ msgid ""
 "******************************************************************************\n"
 "\n"
 msgstr ""
+"\n"
+"*****************************************************************************"
+"*\n"
+"Ditt system är konfigurerat att använda det föråldrade verktyget "
+"sss_ssh_knownhostsproxy.\n"
+"Läs manualsidan sss_ssh_knownhosts(1) för att få reda på mer om dess "
+"ersättning.\n"
+"*****************************************************************************"
+"*\n"
+"\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
 msgid "The port to use to connect to the host"
@@ -2612,26 +2627,24 @@ msgid "Check mapping and matching rule with a certificate"
 msgstr "Kontrollera avbildnings- och matchningsregel för ett certifikat"
 
 #: src/tools/sssctl/sssctl.c:343
-#, fuzzy
 msgid "GPOs related tools:"
-msgstr "Lösennyckelrelaterade verktyg:"
+msgstr "GPO-relaterade verktyg:"
 
 #: src/tools/sssctl/sssctl.c:344
-#, fuzzy
 msgid "Information about cached GPO"
-msgstr "Information om cachad användare"
+msgstr "Information om cachad GPO"
 
 #: src/tools/sssctl/sssctl.c:345
 msgid "Enumerate cached GPOs"
-msgstr ""
+msgstr "Räkna upp cachade GPO:er"
 
 #: src/tools/sssctl/sssctl.c:346
 msgid "Remove cached GPO"
-msgstr ""
+msgstr "Ta bort cachad GPO"
 
 #: src/tools/sssctl/sssctl.c:347
 msgid "Remove all cached GPOs"
-msgstr ""
+msgstr "Ta bort alla cachade GPO:er"
 
 #: src/tools/sssctl/sssctl.c:349
 msgid "Passkey related tools:"
@@ -2667,25 +2680,24 @@ msgid "Cached in InfoPipe"
 msgstr "Cachad i InfoPipe"
 
 #: src/tools/sssctl/sssctl_cache.c:38
-#, fuzzy
 msgid "Policy Name"
-msgstr "Fullständigt namn"
+msgstr "Policynamn"
 
 #: src/tools/sssctl/sssctl_cache.c:39
 msgid "Policy GUID"
-msgstr ""
+msgstr "Policy-GUID"
 
 #: src/tools/sssctl/sssctl_cache.c:40
 msgid "Policy Path"
-msgstr ""
+msgstr "Policysökväg"
 
 #: src/tools/sssctl/sssctl_cache.c:41
 msgid "Policy file timeout"
-msgstr ""
+msgstr "Policyfiltidsgräns"
 
 #: src/tools/sssctl/sssctl_cache.c:42
 msgid "Policy version"
-msgstr ""
+msgstr "Policyversion"
 
 #: src/tools/sssctl/sssctl_cache.c:566
 #, c-format
@@ -2723,24 +2735,23 @@ msgid "Search by group ID"
 msgstr "Sök via grupp-ID"
 
 #: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
-#, fuzzy
 msgid "Search by GPO guid"
-msgstr "Sök via grupp-ID"
+msgstr "Sök via GPO-guid"
 
 #: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to parse command line: %s\n"
-msgstr "Kan inte tolka kommandoargument\n"
+msgstr "Misslyckades att tolka kommandoraden: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
 #, c-format
 msgid "%s\n"
-msgstr ""
+msgstr "%s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:817
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to print object: %s\n"
-msgstr "Misslyckades med att läsa ”%s”: %s\n"
+msgstr "Misslyckades med att skriva objekt: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
 #: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
@@ -2748,44 +2759,40 @@ msgstr "Misslyckades med att läsa ”%s”: %s\n"
 #: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
 #: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
 #: src/tools/sssctl/sssctl_cache.c:1261
-#, fuzzy
 msgid "talloc failed\n"
-msgstr "malloc misslyckades.\n"
+msgstr "talloc misslyckades\n"
 
 #: src/tools/sssctl/sssctl_cache.c:855
-#, fuzzy
 msgid "Unable to get attribute list!\n"
-msgstr "Kan inte ta reda på serverlistan\n"
+msgstr "Kan inte ta reda på attributlistan\n"
 
 #: src/tools/sssctl/sssctl_cache.c:862
-#, fuzzy
 msgid "Unable to create filter\n"
-msgstr "Kan inte ta bort cache-filer\n"
+msgstr "Kan inte skapa filter\n"
 
 #: src/tools/sssctl/sssctl_cache.c:875
 #, c-format
 msgid "%s [%s]:\n"
-msgstr ""
+msgstr "%s [%s]:\n"
 
 #: src/tools/sssctl/sssctl_cache.c:880
-#, fuzzy
 msgid "Unable to get GPOs base DN\n"
-msgstr "Kan inte ta reda på serverlistan\n"
+msgstr "Kan inte ta reda på GPO:ns bas-DN\n"
 
 #: src/tools/sssctl/sssctl_cache.c:890
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to search sysdb: %s\n"
-msgstr "Kan inte arkivera loggfiler\n"
+msgstr "Kan inte söka i sysdb\n"
 
 #: src/tools/sssctl/sssctl_cache.c:896
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
-msgstr "Det går inte att ansluta till systembussen!\n"
+msgstr "Kan inte konvertera meddelandet till sysdb-attribut: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:945
 #, c-format
 msgid "\t%s: %s\n"
-msgstr ""
+msgstr "\t%s: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
 msgid "\n"
@@ -2793,15 +2800,15 @@ msgstr "\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1031
 msgid "Could not find GUID attribute from GPO entry\n"
-msgstr ""
+msgstr "Kunde inte hitta GUID-attribut i GPO-posten\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1038
 msgid "Could not find description attribute from GPO entry\n"
-msgstr ""
+msgstr "Kunde inte hitta beskrivningsattributet i GPO-posten\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1062
 msgid "Could not delete GPO entry from cache\n"
-msgstr ""
+msgstr "Kunde inte radera GPO-posten från cachen\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1068
 #, c-format
@@ -2809,45 +2816,45 @@ msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
+"GPO-sökvägen lagrades inte ännu i cachen. Ta bort filer manuellt från [%s]\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
-msgstr ""
+msgstr "Kunde inte avgöra verklig sökväg för [%s]: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1088
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
-msgstr ""
+msgstr "Den cachade GPO-sökvägen [%s] är inte under [%s], ignorerar.\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1113
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
-msgstr "Kan inte ta bort loggfiler\n"
+msgstr "Kan inte ta bort hämtade GPO-filer: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1181
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to fetch cache entry: %s\n"
-msgstr "Misslyckades med att läsa ”%s”: %s\n"
+msgstr "Misslyckades med att hämta cacheposten: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1186
-#, fuzzy
 msgid "Could not determine object domain\n"
-msgstr "Kunde inte öppna tillgängliga domäner\n"
+msgstr "Kunde inte avgöra objektdomänen\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1216
 msgid "Could not find GUID attribute in GPO entry\n"
-msgstr ""
+msgstr "Kunde inte hitta GUID-attribut i GPO-posten\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1222
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to delete GPO: %s\n"
-msgstr "Misslyckades med att läsa ”%s”: %s\n"
+msgstr "Misslyckades med att radera GPO: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1226
 #, c-format
 msgid "%s removed from cache\n"
-msgstr ""
+msgstr "%s borttagen från cachen\n"
 
 #: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
 #: src/tools/sssctl/sssctl_cert.c:217
diff --git a/po/tr.po b/po/tr.po
index ef984a4dfd9..06d6fdfe266 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -660,6 +660,9 @@ msgid ""
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
+"SSSD'nin yedek sunucuya başarılı bir şekilde bağlandıktan sonra birincil "
+"sunucuya yeniden bağlanmayı denemeden önce bekleyeceği aralığı saniye "
+"cinsinden belirtir"
 
 #: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Override GID value from the identity provider with this value"
@@ -792,7 +795,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:226
 msgid "Local authentication methods policy "
-msgstr ""
+msgstr "Yerel kimlik doğrulama yöntemleri ilkesi "
 
 #: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA domain"
@@ -1414,7 +1417,7 @@ msgstr "Active Directory aralığı almayı devre dışı bırakın"
 
 #: src/config/SSSDConfig/sssdoptions.py:400
 msgid "Use the ppolicy extension"
-msgstr ""
+msgstr "ppolicy uzantısını kullan"
 
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
@@ -2023,18 +2026,19 @@ msgid "Path of group file sources."
 msgstr "Grup dosya kaynaklarının yolu."
 
 #: src/monitor/monitor.c:819
-#, fuzzy
 msgid "Config operation failed\n"
-msgstr "Dizin işlemi başarısız oldu: %1$s\n"
+msgstr "Yapılandırma işlemi başarısız oldu\n"
 
 #: src/monitor/monitor.c:830
 msgid "'"
-msgstr ""
+msgstr "'"
 
 #: src/monitor/monitor.c:845
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
+"Desteklenmeyen değer '%s' ('%s' yapılandırma seçeneği için)! Yalnızca 'root' "
+"veya '"
 
 #: src/monitor/monitor.c:1975
 msgid "Become a daemon (default)"
@@ -2049,12 +2053,15 @@ msgid "Print version number and exit"
 msgstr "Sürüm numarasını yazdırın ve çıkın"
 
 #: src/monitor/monitor.c:1990
-#, fuzzy, c-format
+#, c-format
 msgid ""
 "\n"
 "Invalid option %s: %s\n"
 "\n"
-msgstr "Dizin işlemi başarısız oldu: %1$s\n"
+msgstr ""
+"\n"
+"Geçersiz seçenek %s: %s\n"
+"\n"
 
 #: src/monitor/monitor.c:2012
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
@@ -2062,21 +2069,23 @@ msgstr "-i|--interactive seçeneğine -D|--daemon ile birlikte izin verilmez\n"
 
 #: src/monitor/monitor.c:2054
 msgid "Failed to get initial capabilities\n"
-msgstr ""
+msgstr "Başlangıç yetenekleri alınamadı\n"
 
 #: src/monitor/monitor.c:2065
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
+"Yetkili (root) olmayan hizmet kullanıcısı desteği oluşturulmadı. % altında "
+"çalıştırılamaz"
 
 #: src/monitor/monitor.c:2082
 #, c-format
 msgid "Can't read config: '%s'\n"
-msgstr ""
+msgstr "Yapılandırma okunamıyor: '%s'\n"
 
 #: src/monitor/monitor.c:2101
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
-msgstr ""
+msgstr "SSSD 'monitor' işlemi başlatılamadı: %s"
 
 #: src/monitor/monitor.c:2194
 msgid "Out of memory\n"
@@ -2151,18 +2160,16 @@ msgid "Domain of the information provider (mandatory)"
 msgstr "Bilgi sağlayıcısının etki alanı (zorunlu)"
 
 #: src/sss_client/common.c:1164
-#, fuzzy
 msgid "Socket has wrong ownership or permissions."
-msgstr "Ortak yuva(public socket) yanlış sahiplik veya izinlere sahip."
+msgstr "Yuva (soket) yanlış sahiplik veya izinlere sahip."
 
 #: src/sss_client/common.c:1167
 msgid "Unexpected format of the server credential message."
 msgstr "Sunucu kimlik bilgisi iletisinin beklenmeyen biçimi."
 
 #: src/sss_client/common.c:1170
-#, fuzzy
 msgid "SSSD is not run by trusted user."
-msgstr "SSSD yetkili kullanıcı(root) tarafından çalıştırılmaz."
+msgstr "SSSD güvenilir kullanıcı tarafından çalıştırılmıyor."
 
 #: src/sss_client/common.c:1173
 msgid "SSSD socket does not exist."
@@ -2194,6 +2201,8 @@ msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
+"Kerberos TGT oturum açma sırasında verilmeyecek, kullanıcı deneyimi "
+"etkilenecektir."
 
 #: src/sss_client/pam_sss.c:72
 msgid "Enter PIN:"
@@ -2255,6 +2264,8 @@ msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
+"Sunucu bu yöntemi desteklemediği için Kerberos TGT verilmedi. Ortak oturum "
+"açma (SSO) deneyiminiz etkilenecektir."
 
 #: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
 msgid "Password change failed. "
@@ -2350,6 +2361,14 @@ msgid ""
 "******************************************************************************\n"
 "\n"
 msgstr ""
+"\n"
+"******************************************************************************\n"
+"Sisteminiz eski sss_ssh_knownhostsproxy aracını kullanacak şekilde "
+"yapılandırıldı.\n"
+"Değiştirilmesi hakkında bilgi edinmek için lütfen sss_ssh_knownhosts(1) "
+"kılavuz sayfasını okuyun.\n"
+"******************************************************************************\n"
+"\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
 msgid "The port to use to connect to the host"
@@ -2653,26 +2672,24 @@ msgid "Check mapping and matching rule with a certificate"
 msgstr "Eşleme ve eşleştirme kuralını bir sertifikayla denetleyin"
 
 #: src/tools/sssctl/sssctl.c:343
-#, fuzzy
 msgid "GPOs related tools:"
-msgstr "Geçiş anahtarıyla ilgili araçlar:"
+msgstr "GPO'larla ilgili araçlar:"
 
 #: src/tools/sssctl/sssctl.c:344
-#, fuzzy
 msgid "Information about cached GPO"
-msgstr "Önbelleğe alınan kullanıcı hakkında bilgi"
+msgstr "Önbelleğe alınan GPO hakkında bilgi"
 
 #: src/tools/sssctl/sssctl.c:345
 msgid "Enumerate cached GPOs"
-msgstr ""
+msgstr "Önbelleğe alınan GPO'ları numaralandır"
 
 #: src/tools/sssctl/sssctl.c:346
 msgid "Remove cached GPO"
-msgstr ""
+msgstr "Önbelleğe alınan GPO'yu kaldır"
 
 #: src/tools/sssctl/sssctl.c:347
 msgid "Remove all cached GPOs"
-msgstr ""
+msgstr "Önbelleğe alınan tüm GPO'ları kaldır"
 
 #: src/tools/sssctl/sssctl.c:349
 msgid "Passkey related tools:"
@@ -2708,25 +2725,24 @@ msgid "Cached in InfoPipe"
 msgstr "InfoPipe'ta önbelleğe alındı"
 
 #: src/tools/sssctl/sssctl_cache.c:38
-#, fuzzy
 msgid "Policy Name"
-msgstr "Tam Ad"
+msgstr "İlke Adı"
 
 #: src/tools/sssctl/sssctl_cache.c:39
 msgid "Policy GUID"
-msgstr ""
+msgstr "İlke GUID'si"
 
 #: src/tools/sssctl/sssctl_cache.c:40
 msgid "Policy Path"
-msgstr ""
+msgstr "İlke Yolu"
 
 #: src/tools/sssctl/sssctl_cache.c:41
 msgid "Policy file timeout"
-msgstr ""
+msgstr "İlke dosyası zaman aşımı"
 
 #: src/tools/sssctl/sssctl_cache.c:42
 msgid "Policy version"
-msgstr ""
+msgstr "İlke sürümü"
 
 #: src/tools/sssctl/sssctl_cache.c:566
 #, c-format
@@ -2764,24 +2780,23 @@ msgid "Search by group ID"
 msgstr "Grup kimliğine göre ara"
 
 #: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
-#, fuzzy
 msgid "Search by GPO guid"
-msgstr "Grup kimliğine göre ara"
+msgstr "GPO GUID'ye göre ara"
 
 #: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to parse command line: %s\n"
-msgstr "Komut bağımsız değişkenleri ayrıştırılamıyor\n"
+msgstr "Komut satırı ayrıştırılamadı: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
 #, c-format
 msgid "%s\n"
-msgstr ""
+msgstr "%s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:817
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to print object: %s\n"
-msgstr "%s açılamadı\n"
+msgstr "Nesne yazdırılamadı: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
 #: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
@@ -2789,44 +2804,40 @@ msgstr "%s açılamadı\n"
 #: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
 #: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
 #: src/tools/sssctl/sssctl_cache.c:1261
-#, fuzzy
 msgid "talloc failed\n"
-msgstr "malloc başarısız oldu.\n"
+msgstr "talloc başarısız oldu.\n"
 
 #: src/tools/sssctl/sssctl_cache.c:855
-#, fuzzy
 msgid "Unable to get attribute list!\n"
-msgstr "Sunucu listesi alınamıyor\n"
+msgstr "Öznitelik listesi alınamıyor!\n"
 
 #: src/tools/sssctl/sssctl_cache.c:862
-#, fuzzy
 msgid "Unable to create filter\n"
-msgstr "Önbellek dosyaları kaldırılamıyor\n"
+msgstr "Filtre oluşturulamıyor\n"
 
 #: src/tools/sssctl/sssctl_cache.c:875
 #, c-format
 msgid "%s [%s]:\n"
-msgstr ""
+msgstr "%s [%s]:\n"
 
 #: src/tools/sssctl/sssctl_cache.c:880
-#, fuzzy
 msgid "Unable to get GPOs base DN\n"
-msgstr "Sunucu listesi alınamıyor\n"
+msgstr "GPO'ların temel DN'si alınamıyor\n"
 
 #: src/tools/sssctl/sssctl_cache.c:890
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to search sysdb: %s\n"
-msgstr "Günlük dosyaları arşivlenemiyor\n"
+msgstr "sysdb aranamıyor: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:896
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
-msgstr "Sistem veriyoluna bağlanılamıyor!\n"
+msgstr "İleti sysdb özniteliklerine dönüştürülemiyor: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:945
 #, c-format
 msgid "\t%s: %s\n"
-msgstr ""
+msgstr "\t%s: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
 msgid "\n"
@@ -2834,15 +2845,15 @@ msgstr "\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1031
 msgid "Could not find GUID attribute from GPO entry\n"
-msgstr ""
+msgstr "GPO girdisinden GUID özniteliği bulunamadı\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1038
 msgid "Could not find description attribute from GPO entry\n"
-msgstr ""
+msgstr "GPO girdisinden açıklama özniteliği bulunamadı\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1062
 msgid "Could not delete GPO entry from cache\n"
-msgstr ""
+msgstr "GPO girdisi önbellekten silinemedi\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1068
 #, c-format
@@ -2850,45 +2861,46 @@ msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
+"GPO yolu henüz önbellekte depolanmadı. Lütfen dosyaları [%s] içinden elle "
+"kaldırın\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
-msgstr ""
+msgstr "[%s] için gerçek yol belirlenemedi: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1088
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
-msgstr ""
+msgstr "Önbelleğe alınan GPO yolu [%s], [%s] altında değil, yok sayılıyor.\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1113
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
-msgstr "Günlük dosyaları kaldırılamıyor\n"
+msgstr "İndirilen GPO dosyaları kaldırılamıyor: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1181
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to fetch cache entry: %s\n"
-msgstr "%s açılamadı\n"
+msgstr "Önbellek girdisi alınamadı: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1186
-#, fuzzy
 msgid "Could not determine object domain\n"
-msgstr "Kullanılabilir etki alanları açılamadı\n"
+msgstr "Nesne etki alanı belirlenemedi\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1216
 msgid "Could not find GUID attribute in GPO entry\n"
-msgstr ""
+msgstr "GPO girdisinde GUID özniteliği bulunamadı\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1222
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to delete GPO: %s\n"
-msgstr "%s açılamadı\n"
+msgstr "GPO silinemedi: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1226
 #, c-format
 msgid "%s removed from cache\n"
-msgstr ""
+msgstr "%s önbellekten kaldırıldı\n"
 
 #: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
 #: src/tools/sssctl/sssctl_cert.c:217
@@ -2991,9 +3003,9 @@ msgid "There is no configuration.\n"
 msgstr "Yapılandırma yok..\n"
 
 #: src/tools/sssctl/sssctl_config.c:121
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to read '%s': %s\n"
-msgstr "%s açılamadı\n"
+msgstr "'%s' okunamadı: %s\n"
 
 #: src/tools/sssctl/sssctl_config.c:130
 msgid "Failed to run validators"
diff --git a/po/uk.po b/po/uk.po
index 076ae541a9f..06beaf55b56 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -4,20 +4,20 @@
 #
 # Translators:
 # sgallagh <sgallagh@redhat.com>, 2011
-# Yuri Chornoivan <yurchor@ukr.net>, 2011-2014, 2020, 2021, 2022, 2023.
-# Yuri Chornoivan <yurchor@ukr.net>, 2013, 2020, 2021, 2022, 2023.
-# Yuri Chornoivan <yurchor@ukr.net>, 2015. #zanata, 2020, 2021, 2022, 2023.
-# Yuri Chornoivan <yurchor@ukr.net>, 2017. #zanata, 2020, 2021, 2022, 2023.
-# Yuri Chornoivan <yurchor@ukr.net>, 2018. #zanata, 2020, 2021, 2022, 2023.
-# Yuri Chornoivan <yurchor@ukr.net>, 2019. #zanata, 2020, 2021, 2022, 2023.
-# Yuri Chornoivan <yurchor@ukr.net>, 2020. #zanata, 2021, 2022, 2023.
+# Yuri Chornoivan <yurchor@ukr.net>, 2011-2014, 2020, 2021, 2022, 2023, 2024.
+# Yuri Chornoivan <yurchor@ukr.net>, 2013, 2020, 2021, 2022, 2023, 2024.
+# Yuri Chornoivan <yurchor@ukr.net>, 2015. #zanata, 2020, 2021, 2022, 2023, 2024.
+# Yuri Chornoivan <yurchor@ukr.net>, 2017. #zanata, 2020, 2021, 2022, 2023, 2024.
+# Yuri Chornoivan <yurchor@ukr.net>, 2018. #zanata, 2020, 2021, 2022, 2023, 2024.
+# Yuri Chornoivan <yurchor@ukr.net>, 2019. #zanata, 2020, 2021, 2022, 2023, 2024.
+# Yuri Chornoivan <yurchor@ukr.net>, 2020. #zanata, 2021, 2022, 2023, 2024.
 # Elena Mishina <lepata@basealt.ru>, 2023.
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
 "POT-Creation-Date: 2024-06-25 13:26+0200\n"
-"PO-Revision-Date: 2023-09-16 08:35+0000\n"
+"PO-Revision-Date: 2024-06-27 05:36+0000\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-master/uk/>\n"
@@ -27,7 +27,7 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
 "n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
-"X-Generator: Weblate 5.0.1\n"
+"X-Generator: Weblate 5.5.5\n"
 
 #: src/config/SSSDConfig/sssdoptions.py:20
 #: src/config/SSSDConfig/sssdoptions.py:21
@@ -675,6 +675,9 @@ msgid ""
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
+"Визначає інтервал, у секундах, протягом якого SSSD очічкуватиме на спробу "
+"повторного з'єднання із основним сервером після успішного встановлення "
+"з'єднання із резервним сервером"
 
 #: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Override GID value from the identity provider with this value"
@@ -1452,7 +1455,7 @@ msgstr "Вимкнути отримання діапазонів Active Director
 
 #: src/config/SSSDConfig/sssdoptions.py:400
 msgid "Use the ppolicy extension"
-msgstr ""
+msgstr "Використати розширення ppolicy"
 
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
@@ -2073,18 +2076,19 @@ msgid "Path of group file sources."
 msgstr "Шлях до початкового тексту файла group."
 
 #: src/monitor/monitor.c:819
-#, fuzzy
 msgid "Config operation failed\n"
-msgstr "Помилка дії з покажчиком: %1$s\n"
+msgstr "Помилка дії з налаштуваннями\n"
 
 #: src/monitor/monitor.c:830
 msgid "'"
-msgstr ""
+msgstr "'"
 
 #: src/monitor/monitor.c:845
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
+"Непідтримуване значення «%s» параметра налаштувань «%s»! Передбачено "
+"підтримку лише 'root' і '"
 
 #: src/monitor/monitor.c:1975
 msgid "Become a daemon (default)"
@@ -2099,12 +2103,15 @@ msgid "Print version number and exit"
 msgstr "Вивести номер версії і завершити роботу"
 
 #: src/monitor/monitor.c:1990
-#, fuzzy, c-format
+#, c-format
 msgid ""
 "\n"
 "Invalid option %s: %s\n"
 "\n"
-msgstr "Помилка дії з покажчиком: %1$s\n"
+msgstr ""
+"\n"
+"Некоректний параметр %s: %s\n"
+"\n"
 
 #: src/monitor/monitor.c:2012
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
@@ -2113,21 +2120,22 @@ msgstr ""
 
 #: src/monitor/monitor.c:2054
 msgid "Failed to get initial capabilities\n"
-msgstr ""
+msgstr "Не вдалося отримати початкові можливості\n"
 
 #: src/monitor/monitor.c:2065
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
+"Підтримку служб користувача поза root не зібрано. Неможливий запуск від %"
 
 #: src/monitor/monitor.c:2082
 #, c-format
 msgid "Can't read config: '%s'\n"
-msgstr ""
+msgstr "Не вдалося прочитати налаштування: '%s'\n"
 
 #: src/monitor/monitor.c:2101
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
-msgstr ""
+msgstr "Не вдалося виконати початкове завантаження процесу «monitor» SSSD: %s"
 
 #: src/monitor/monitor.c:2194
 msgid "Out of memory\n"
@@ -2204,18 +2212,16 @@ msgid "Domain of the information provider (mandatory)"
 msgstr "Домен надання відомостей (обов’язковий)"
 
 #: src/sss_client/common.c:1164
-#, fuzzy
 msgid "Socket has wrong ownership or permissions."
-msgstr "У відкритого сокета помилковий власник або права доступу."
+msgstr "Сокет має помилкового власника або помилкові права доступу."
 
 #: src/sss_client/common.c:1167
 msgid "Unexpected format of the server credential message."
 msgstr "Некоректний формат повідомлення щодо реєстраційних даних сервера."
 
 #: src/sss_client/common.c:1170
-#, fuzzy
 msgid "SSSD is not run by trusted user."
-msgstr "SSSD запущено не від імені користувача root."
+msgstr "SSSD запущено не від імені довіреного користувача."
 
 #: src/sss_client/common.c:1173
 msgid "SSSD socket does not exist."
@@ -2408,6 +2414,14 @@ msgid ""
 "******************************************************************************\n"
 "\n"
 msgstr ""
+"\n"
+"*****************************************************************************"
+"*\n"
+"У вашій системі використано застарілу програму sss_ssh_knownhostsproxy.\n"
+"Ознайомтеся із довідкою до sss_ssh_knownhosts(1), щоб її замінити.\n"
+"*****************************************************************************"
+"*\n"
+"\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
 msgid "The port to use to connect to the host"
@@ -2709,26 +2723,24 @@ msgid "Check mapping and matching rule with a certificate"
 msgstr "Перевірити прив'язку та правило відповідності за допомогою сертифіката"
 
 #: src/tools/sssctl/sssctl.c:343
-#, fuzzy
 msgid "GPOs related tools:"
-msgstr "Пов'язані із ключем інструменти:"
+msgstr "Пов'язані із GPO інструменти:"
 
 #: src/tools/sssctl/sssctl.c:344
-#, fuzzy
 msgid "Information about cached GPO"
-msgstr "Відомості щодо кешованого користувача"
+msgstr "Відомості щодо кешованого GPO"
 
 #: src/tools/sssctl/sssctl.c:345
 msgid "Enumerate cached GPOs"
-msgstr ""
+msgstr "Нумерувати кешовані GPO"
 
 #: src/tools/sssctl/sssctl.c:346
 msgid "Remove cached GPO"
-msgstr ""
+msgstr "Вилучити кешований GPO"
 
 #: src/tools/sssctl/sssctl.c:347
 msgid "Remove all cached GPOs"
-msgstr ""
+msgstr "Вилучити усі кешовані GPO"
 
 #: src/tools/sssctl/sssctl.c:349
 msgid "Passkey related tools:"
@@ -2764,25 +2776,24 @@ msgid "Cached in InfoPipe"
 msgstr "Кешовано в InfoPipe"
 
 #: src/tools/sssctl/sssctl_cache.c:38
-#, fuzzy
 msgid "Policy Name"
-msgstr "Повне ім'я"
+msgstr "Назва правил"
 
 #: src/tools/sssctl/sssctl_cache.c:39
 msgid "Policy GUID"
-msgstr ""
+msgstr "GUID правил"
 
 #: src/tools/sssctl/sssctl_cache.c:40
 msgid "Policy Path"
-msgstr ""
+msgstr "Шлях правил"
 
 #: src/tools/sssctl/sssctl_cache.c:41
 msgid "Policy file timeout"
-msgstr ""
+msgstr "Час очікування файла правил"
 
 #: src/tools/sssctl/sssctl_cache.c:42
 msgid "Policy version"
-msgstr ""
+msgstr "Версія правил"
 
 #: src/tools/sssctl/sssctl_cache.c:566
 #, c-format
@@ -2820,24 +2831,23 @@ msgid "Search by group ID"
 msgstr "Шукати за ідентифікатором групи"
 
 #: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
-#, fuzzy
 msgid "Search by GPO guid"
-msgstr "Шукати за ідентифікатором групи"
+msgstr "Шукати за GUID GPO"
 
 #: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to parse command line: %s\n"
-msgstr "Не вдалося обробити аргументи команди\n"
+msgstr "Не вдалося обробити рядок команди: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
 #, c-format
 msgid "%s\n"
-msgstr ""
+msgstr "%s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:817
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to print object: %s\n"
-msgstr "Не вдалося прочитати «%s»: %s\n"
+msgstr "Не вдалося надрукувати об'єкт: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
 #: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
@@ -2845,45 +2855,40 @@ msgstr "Не вдалося прочитати «%s»: %s\n"
 #: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
 #: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
 #: src/tools/sssctl/sssctl_cache.c:1261
-#, fuzzy
 msgid "talloc failed\n"
-msgstr "Помилка malloc.\n"
+msgstr "Помилка talloc\n"
 
 #: src/tools/sssctl/sssctl_cache.c:855
-#, fuzzy
 msgid "Unable to get attribute list!\n"
-msgstr "Не вдалося отримати список серверів\n"
+msgstr "Не вдалося отримати список атрибутів!\n"
 
 #: src/tools/sssctl/sssctl_cache.c:862
-#, fuzzy
 msgid "Unable to create filter\n"
-msgstr "Не вдалося вилучити файли кешу\n"
+msgstr "Не вдалося створити фільтр\n"
 
 #: src/tools/sssctl/sssctl_cache.c:875
 #, c-format
 msgid "%s [%s]:\n"
-msgstr ""
+msgstr "%s [%s]:\n"
 
 #: src/tools/sssctl/sssctl_cache.c:880
-#, fuzzy
 msgid "Unable to get GPOs base DN\n"
-msgstr "Не вдалося отримати список серверів\n"
+msgstr "Не вдлаося отримати базову DN GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:890
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to search sysdb: %s\n"
-msgstr "Не вдалося архівувати файли журналу\n"
+msgstr "Не вдалося виконати пошук у sysdb: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:896
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
-msgstr ""
-"Не вдалося встановити з'єднання із системним каналом передавання даних!\n"
+msgstr "Не вдалося перетворити повідомлення на атрибути sysdb: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:945
 #, c-format
 msgid "\t%s: %s\n"
-msgstr ""
+msgstr "\t%s: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
 msgid "\n"
@@ -2891,15 +2896,15 @@ msgstr "\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1031
 msgid "Could not find GUID attribute from GPO entry\n"
-msgstr ""
+msgstr "Не вдалося знайти атрибут GUID за записом GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1038
 msgid "Could not find description attribute from GPO entry\n"
-msgstr ""
+msgstr "Не вдалося знайти атрибут опису за записом GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1062
 msgid "Could not delete GPO entry from cache\n"
-msgstr ""
+msgstr "Не вдалося вилучити запис GPO з кешу\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1068
 #, c-format
@@ -2907,45 +2912,46 @@ msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
+"Шлях GPO ще не зберігається у кеші. Будь ласка, вилучіть файли з [%s] "
+"вручну\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
-msgstr ""
+msgstr "Не вдалося визначити справжній шлях для [%s]: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1088
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
-msgstr ""
+msgstr "Кешований шлях GPO [%s] не перебуває у [%s], ігноруємо.\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1113
-#, fuzzy, c-format
+#, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
-msgstr "Не вдалося вилучити файли журналу\n"
+msgstr "Не вдалося вилучити отримані файли GPO: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1181
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to fetch cache entry: %s\n"
-msgstr "Не вдалося прочитати «%s»: %s\n"
+msgstr "Не вдалося отримати запис кешу: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1186
-#, fuzzy
 msgid "Could not determine object domain\n"
-msgstr "Не вдалося відкрити доступні домени\n"
+msgstr "Не вдалося визначити домен об'єкта\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1216
 msgid "Could not find GUID attribute in GPO entry\n"
-msgstr ""
+msgstr "Не вдалося знайти атрибут GUID у записі GPO\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1222
-#, fuzzy, c-format
+#, c-format
 msgid "Failed to delete GPO: %s\n"
-msgstr "Не вдалося прочитати «%s»: %s\n"
+msgstr "Не вдалося вилучити GPO: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:1226
 #, c-format
 msgid "%s removed from cache\n"
-msgstr ""
+msgstr "%s вилучено з кешу\n"
 
 #: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
 #: src/tools/sssctl/sssctl_cert.c:217
diff --git a/src/man/po/cs.po b/src/man/po/cs.po
index 66756cfbf56..95ed6424257 100644
--- a/src/man/po/cs.po
+++ b/src/man/po/cs.po
@@ -11,16 +11,16 @@ msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
 "POT-Creation-Date: 2024-06-25 13:25+0200\n"
-"PO-Revision-Date: 2022-05-20 09:18+0000\n"
-"Last-Translator: Pavel Borecki <pavel.borecki@gmail.com>\n"
-"Language-Team: Czech <https://translate.fedoraproject.org/projects/sssd/sssd-"
-"manpage-master/cs/>\n"
+"PO-Revision-Date: 2024-09-02 11:38+0000\n"
+"Last-Translator: Jan Kalabza <jan.kalabza@gmail.com>\n"
+"Language-Team: Czech <https://translate.fedoraproject.org/projects/sssd/"
+"sssd-manpage-master/cs/>\n"
 "Language: cs\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=3; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2;\n"
-"X-Generator: Weblate 4.12.2\n"
+"X-Generator: Weblate 5.7.1\n"
 
 #. type: Content of: <reference><title>
 #: sssd.conf.5.xml:8 sssd-ldap.5.xml:5 pam_sss.8.xml:5 pam_sss_gss.8.xml:5
@@ -322,7 +322,7 @@ msgstr ""
 #: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
 #: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
-msgstr ""
+msgstr "Výchozí: 10"
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:209
@@ -1080,7 +1080,7 @@ msgstr ""
 #: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
 #: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
 msgid "Default: 60"
-msgstr ""
+msgstr "Výchozí: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:861
@@ -1164,10 +1164,8 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:913
-#, fuzzy
-#| msgid "Default: 200000"
 msgid "Default: 30"
-msgstr "Výchozí: 200000"
+msgstr "Výchozí: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:918
@@ -1190,7 +1188,7 @@ msgstr ""
 #: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
-msgstr ""
+msgstr "Výchozí: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:940
@@ -1270,7 +1268,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
 msgid "Default: 50"
-msgstr ""
+msgstr "Výchozí: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1009
@@ -1288,7 +1286,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
 msgid "Default: 15"
-msgstr ""
+msgstr "Výchozí: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1023
@@ -1377,7 +1375,7 @@ msgstr ""
 #: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
 #: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
-msgstr ""
+msgstr "příklad: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1093
@@ -1792,7 +1790,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1463 sssd.8.xml:63
 msgid "Default: 1"
-msgstr ""
+msgstr "Výchozí: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1469
@@ -1995,7 +1993,7 @@ msgstr ""
 #: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
 #: sssd-ldap.5.xml:1209
 msgid "Default: none"
-msgstr ""
+msgstr "Výchozí: nic"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1635
@@ -2058,7 +2056,7 @@ msgstr ""
 #: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
-msgstr ""
+msgstr "Výchozí: true (pravda)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1690
@@ -2076,7 +2074,7 @@ msgstr ""
 #: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
-msgstr ""
+msgstr "Výchozí: false (nepravda)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1701
@@ -2104,7 +2102,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
 msgid "Default:"
-msgstr ""
+msgstr "Výchozí:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
 #: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
@@ -2151,7 +2149,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1761
 msgid "How many seconds will pam_sss wait for p11_child to finish."
-msgstr ""
+msgstr "Kolik sekund bude pam_sss čekat na dokončení p11_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1770
@@ -2221,7 +2219,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
 #: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
 msgid "login"
-msgstr ""
+msgstr "přihlášení"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
 #: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
@@ -2325,7 +2323,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1924
 msgid "always"
-msgstr ""
+msgstr "vždy"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1925
@@ -2348,7 +2346,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1935
 msgid "never"
-msgstr ""
+msgstr "nikdy"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1936
@@ -2408,7 +2406,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
-msgstr ""
+msgstr "Příklad: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1972
@@ -2617,6 +2615,8 @@ msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
+"Zda se mají názvy a adresy hostitelů ve spravovaném souboru known_hosts "
+"zaheslovat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:2171
@@ -2629,6 +2629,8 @@ msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
+"Kolik sekund má hostitel zůstat ve spravovaném souboru known_hosts poté, co "
+"byly vyžádány klíče hostitele."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2178
@@ -2982,12 +2984,12 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
 msgid "\"all\""
-msgstr ""
+msgstr "\"vše\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
-msgstr ""
+msgstr "Všichni uživatelé jsou zaznamenáni."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
@@ -2995,6 +2997,8 @@ msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
+"Jeden z následujících řetězců určujících rozsah záznamu relace: <placeholder "
+"type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
diff --git a/src/man/po/ru.po b/src/man/po/ru.po
index 9e9a5c4ed55..b333dd1995c 100644
--- a/src/man/po/ru.po
+++ b/src/man/po/ru.po
@@ -9,7 +9,7 @@ msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
 "POT-Creation-Date: 2024-06-25 13:25+0200\n"
-"PO-Revision-Date: 2024-06-21 14:36+0000\n"
+"PO-Revision-Date: 2024-07-17 21:38+0000\n"
 "Last-Translator: Elena Mishina <lepata@basealt.ru>\n"
 "Language-Team: Russian <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-manpage-master/ru/>\n"
@@ -19,7 +19,7 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
 "n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
-"X-Generator: Weblate 5.5.5\n"
+"X-Generator: Weblate 5.6.2\n"
 
 #. type: Content of: <reference><title>
 #: sssd.conf.5.xml:8 sssd-ldap.5.xml:5 pam_sss.8.xml:5 pam_sss_gss.8.xml:5
@@ -77,9 +77,10 @@ msgid ""
 "<replaceable>key2</replaceable> = <replaceable>value2,value3</replaceable>\n"
 "            "
 msgstr ""
-"<replaceable>[section]</replaceable>\n"
-"<replaceable>key</replaceable> = <replaceable>value</replaceable>\n"
-"<replaceable>key2</replaceable> = <replaceable>value2,value3</replaceable>\n"
+"<replaceable>[раздел]</replaceable>\n"
+"<replaceable>ключ</replaceable> = <replaceable>значение</replaceable>\n"
+"<replaceable>ключ2</replaceable> = "
+"<replaceable>значение2,значение3</replaceable>\n"
 "            "
 
 #. type: Content of: <reference><refentry><refsect1><para>
@@ -262,7 +263,9 @@ msgstr ""
 #: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
 #: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
 #: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358 sssd.conf.5.xml:710
+#: sssd.conf.5.xml:725 sssd.conf.5.xml:948 sssd.conf.5.xml:1066
+#: sssd.conf.5.xml:2194
 msgid "Default: true"
 msgstr "По умолчанию: true"
 
@@ -288,6 +291,8 @@ msgstr ""
 #: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
 #: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
+#: sssd.conf.5.xml:648 sssd.conf.5.xml:945 sssd.conf.5.xml:2097
+#: sssd.conf.5.xml:2164 sssd.conf.5.xml:4250
 msgid "Default: false"
 msgstr "По умолчанию: false"
 
@@ -364,6 +369,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
 #: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:1286 sssd.conf.5.xml:1763 sssd.conf.5.xml:4266
 msgid "Default: 10"
 msgstr "По умолчанию: 10"
 
@@ -427,12 +433,12 @@ msgstr ""
 "следующей команды: «systemctl enable sssd-@service@.socket».  </phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
+#: sssd.conf.5.xml:252 sssd.conf.5.xml:782 sssd.conf.5.xml:780
 msgid "reconnection_retries (integer)"
 msgstr "reconnection_retries (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
+#: sssd.conf.5.xml:255 sssd.conf.5.xml:785 sssd.conf.5.xml:783
 msgid ""
 "Number of times services should attempt to reconnect in the event of a Data "
 "Provider crash or restart before they give up"
@@ -442,7 +448,7 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
+#: include/failover.xml:100 sssd.conf.5.xml:788 sssd.conf.5.xml:3722
 msgid "Default: 3"
 msgstr "По умолчанию: 3"
 
@@ -470,7 +476,7 @@ msgstr ""
 "Символ «/» использовать нельзя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562 sssd.conf.5.xml:3554
 msgid "re_expression (string)"
 msgstr "re_expression (строка)"
 
@@ -496,12 +502,12 @@ msgstr ""
 "разделе справки «РАЗДЕЛЫ ДОМЕНА»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619 sssd.conf.5.xml:3611
 msgid "full_name_format (string)"
 msgstr "full_name_format (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622 sssd.conf.5.xml:3614
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -512,32 +518,32 @@ msgstr ""
 "создания полностью определённого имени из имени пользователя и имени домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633 sssd.conf.5.xml:3625
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634 sssd.conf.5.xml:3626
 msgid "user name"
 msgstr "имя пользователя"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637 sssd.conf.5.xml:3629
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640 sssd.conf.5.xml:3632
 msgid "domain name as specified in the SSSD config file."
 msgstr "имя домена, указанное в файле конфигурации SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646 sssd.conf.5.xml:3638
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649 sssd.conf.5.xml:3641
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -547,7 +553,7 @@ msgstr ""
 "доверия IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630 sssd.conf.5.xml:3622
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -962,11 +968,6 @@ msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:601
-#, fuzzy
-#| msgid ""
-#| "If a Certificate Revocation List (CRL)  is expired ignore the CRL checks "
-#| "for the related certificates. This option should be used to allow "
-#| "authentication when the system is offline and the CRL cannot be renewed."
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -990,22 +991,22 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:614 sssd.conf.5.xml:612
 msgid "Unknown options are reported but ignored."
 msgstr "Неизвестные параметры передаются, но игнорируются."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:617 sssd.conf.5.xml:615
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr "По умолчанию: не задано, то есть не ограничивать проверку сертификатов"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:623 sssd.conf.5.xml:621
 msgid "disable_netlink (boolean)"
 msgstr "disable_netlink (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:626 sssd.conf.5.xml:624
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
@@ -1014,7 +1015,7 @@ msgstr ""
 "маршрутах,адресах, ссылках и вызова определённых действий."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:631 sssd.conf.5.xml:629
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
@@ -1024,17 +1025,17 @@ msgstr ""
 "«true»"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:636 sssd.conf.5.xml:634
 msgid "Default: false (netlink changes are detected)"
 msgstr "По умолчанию: false (изменения netlink обнаруживаются)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:641 sssd.conf.5.xml:639
 msgid "enable_files_domain (boolean)"
 msgstr "enable_files_domain (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:644 sssd.conf.5.xml:642
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
@@ -1043,12 +1044,12 @@ msgstr ""
 "доменами неявный домен с<quote>id_provider=files</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:655 sssd.conf.5.xml:653
 msgid "domain_resolution_order"
 msgstr "domain_resolution_order"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:658 sssd.conf.5.xml:656
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -1065,7 +1066,7 @@ msgstr ""
 "будет выполняться в случайном порядке для каждого родительского домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:670 sssd.conf.5.xml:668
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -1099,17 +1100,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341 sssd.conf.5.xml:696
+#: sssd.conf.5.xml:1787 sssd.conf.5.xml:4316
 msgid "Default: Not set"
 msgstr "По умолчанию: не задано"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:703 sssd.conf.5.xml:701
 msgid "implicit_pac_responder (boolean)"
 msgstr "implicit_pac_responder (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:706 sssd.conf.5.xml:704
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -1120,12 +1122,12 @@ msgstr ""
 "значение «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:717 sssd.conf.5.xml:715
 msgid "core_dumpable (boolean)"
 msgstr "core_dumpable (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:720 sssd.conf.5.xml:718
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1137,17 +1139,17 @@ msgstr ""
 "доступны на справочной странице prctl:PR_SET_DUMPABLE."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:732 sssd.conf.5.xml:730
 msgid "passkey_verification (string)"
 msgstr "passkey_verification (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:740 sssd.conf.5.xml:738
 msgid "user_verification (boolean)"
 msgstr "user_verification (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:742 sssd.conf.5.xml:740
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
@@ -1157,7 +1159,7 @@ msgstr ""
 "запрашиваться всегда."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:748 sssd.conf.5.xml:746
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1168,7 +1170,7 @@ msgstr ""
 "перезаписано сервером."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:735 sssd.conf.5.xml:733
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -1196,12 +1198,12 @@ msgstr ""
 "<quote>[sssd]</quote>. <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:767 sssd.conf.5.xml:765
 msgid "SERVICES SECTIONS"
 msgstr "РАЗДЕЛЫ СЛУЖБ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:769 sssd.conf.5.xml:767
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1214,22 +1216,22 @@ msgstr ""
 "раздел <quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:776 sssd.conf.5.xml:774
 msgid "General service configuration options"
 msgstr "Общие параметры настройки служб"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:778 sssd.conf.5.xml:776
 msgid "These options can be used to configure any service."
 msgstr "Эти параметры можно использовать для настройки любых служб."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:795 sssd.conf.5.xml:793
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:798 sssd.conf.5.xml:796
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1245,17 +1247,17 @@ msgstr ""
 "ограничением «hard» в limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:807 sssd.conf.5.xml:805
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "По умолчанию: 8192 (или ограничение «hard» в limits.conf)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:812 sssd.conf.5.xml:810
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:815 sssd.conf.5.xml:813
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1270,17 +1272,17 @@ msgstr ""
 "на 10 секунд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:824 sssd.conf.5.xml:822
 msgid "Default: 60, KCM: 300"
 msgstr "По умолчанию: 60, KCM: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:827
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:832 sssd.conf.5.xml:830
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1298,7 +1300,8 @@ msgstr ""
 "следующей формуле:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:843 sssd.conf.5.xml:899 sssd.conf.5.xml:841
+#: sssd.conf.5.xml:897
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
@@ -1307,7 +1310,7 @@ msgstr ""
 "offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:846 sssd.conf.5.xml:844
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1319,7 +1322,7 @@ msgstr ""
 "количество секунд до следующей попытки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:852 sssd.conf.5.xml:850
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
@@ -1329,17 +1332,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495 sssd.conf.5.xml:854
+#: sssd.conf.5.xml:1197 sssd.conf.5.xml:1580 sssd.conf.5.xml:1876
 msgid "Default: 60"
 msgstr "По умолчанию: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:861 sssd.conf.5.xml:859
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout_max (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:864 sssd.conf.5.xml:862
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
@@ -1348,12 +1352,12 @@ msgstr ""
 "сеть после неудачных попыток восстановления подключения."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:869 sssd.conf.5.xml:867
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr "Значение «0» отключает использование приращения."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:872 sssd.conf.5.xml:870
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
@@ -1362,7 +1366,7 @@ msgstr ""
 "offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:876 sssd.conf.5.xml:874
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1376,7 +1380,7 @@ msgstr ""
 "4 раза превышать значение offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:882 sssd.conf.5.xml:880
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
@@ -1386,17 +1390,17 @@ msgstr ""
 "имеет практического смысла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:887 sssd.conf.5.xml:885
 msgid "Default: 3600"
 msgstr "По умолчанию: 3600"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:892 sssd.conf.5.xml:890
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout_random_offset (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:895 sssd.conf.5.xml:893
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
@@ -1405,7 +1409,7 @@ msgstr ""
 "внутренним серверам через заданные промежутки времени:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:902 sssd.conf.5.xml:900
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
@@ -1415,27 +1419,27 @@ msgstr ""
 "случайное число, принадлежащее диапазону:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:907 sssd.conf.5.xml:905
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "[0 - offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:910 sssd.conf.5.xml:908
 msgid "A value of 0 disables the random offset addition."
 msgstr "Значение «0» отключает добавление случайной задержки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:913 sssd.conf.5.xml:911
 msgid "Default: 30"
 msgstr "По умолчанию: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:918 sssd.conf.5.xml:916
 msgid "responder_idle_timeout"
 msgstr "responder_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:921 sssd.conf.5.xml:919
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1455,17 +1459,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
-#: sssd-ldap.5.xml:332
+#: sssd-ldap.5.xml:332 sssd.conf.5.xml:933 sssd.conf.5.xml:1210
+#: sssd.conf.5.xml:2329
 msgid "Default: 300"
 msgstr "По умолчанию: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:940 sssd.conf.5.xml:938
 msgid "cache_first"
 msgstr "cache_first"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:943 sssd.conf.5.xml:941
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
@@ -1474,12 +1479,12 @@ msgstr ""
 "опросом поставщиков данных."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:958 sssd.conf.5.xml:956
 msgid "NSS configuration options"
 msgstr "Параметры настройки NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:960 sssd.conf.5.xml:958
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1487,12 +1492,12 @@ msgstr ""
 "(NSS)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:965 sssd.conf.5.xml:963
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:968 sssd.conf.5.xml:966
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1501,17 +1506,17 @@ msgstr ""
 "пользователях) в кэше nss_sss в секундах"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:972 sssd.conf.5.xml:970
 msgid "Default: 120"
 msgstr "По умолчанию: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:975
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:980 sssd.conf.5.xml:978
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1522,7 +1527,7 @@ msgstr ""
 "значения entry_cache_timeout для домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:986 sssd.conf.5.xml:984
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1538,7 +1543,7 @@ msgstr ""
 "ожидании обновления кэша."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:996 sssd.conf.5.xml:994
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1552,17 +1557,18 @@ msgstr ""
 "значения «0» отключает эту возможность."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120 sssd.conf.5.xml:1002
+#: sssd.conf.5.xml:2118
 msgid "Default: 50"
 msgstr "По умолчанию: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:1009 sssd.conf.5.xml:1007
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:1012 sssd.conf.5.xml:1010
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1575,16 +1581,17 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:1016 sssd.conf.5.xml:1775 sssd.conf.5.xml:2142
 msgid "Default: 15"
 msgstr "По умолчанию: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:1023 sssd.conf.5.xml:1021
 msgid "local_negative_timeout (integer)"
 msgstr "local_negative_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:1026 sssd.conf.5.xml:1024
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1596,17 +1603,17 @@ msgstr ""
 "возможность."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1032 sssd.conf.5.xml:1030
 msgid "Default: 14400 (4 hours)"
 msgstr "По умолчанию: 14400 (4 часа)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1037 sssd.conf.5.xml:1035
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1040 sssd.conf.5.xml:1038
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1621,7 +1628,7 @@ msgstr ""
 "(UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1048 sssd.conf.5.xml:1046
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1635,17 +1642,17 @@ msgstr ""
 "отфильтрованной вложенной группы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1056 sssd.conf.5.xml:1054
 msgid "Default: root"
 msgstr "По умолчанию: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1061 sssd.conf.5.xml:1059
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1064 sssd.conf.5.xml:1062
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1653,12 +1660,12 @@ msgstr ""
 "установите этот параметр в значение «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1075 sssd.conf.5.xml:1073
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1078 sssd.conf.5.xml:1076
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1667,7 +1674,7 @@ msgstr ""
 "явно не указан поставщиком данных домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1083 sssd.conf.5.xml:1081
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1675,7 +1682,7 @@ msgstr ""
 "параметра override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1089 sssd.conf.5.xml:1087
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1687,21 +1694,23 @@ msgstr ""
 #. type: Content of: <varlistentry><listitem><para>
 #: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
 #: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1085 sssd.conf.5.xml:1647 sssd.conf.5.xml:1666
+#: sssd.conf.5.xml:1743
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "пример: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1093 sssd.conf.5.xml:1091
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr "По умолчанию: не задано (без замен для незаданных домашних каталогов)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1099 sssd.conf.5.xml:1097
 msgid "override_shell (string)"
 msgstr "override_shell (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1102 sssd.conf.5.xml:1100
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1713,19 +1722,19 @@ msgstr ""
 "домена отдельно."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1108 sssd.conf.5.xml:1106
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "По умолчанию: не задано (SSSD будет использовать значение, полученное от "
 "LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1114 sssd.conf.5.xml:1112
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1117 sssd.conf.5.xml:1115
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1733,14 +1742,14 @@ msgstr ""
 "Порядок вычисления:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1120 sssd.conf.5.xml:1118
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 "1. Если оболочка присутствует в файле <quote>/etc/shells</quote>, будет "
 "использована она."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1124 sssd.conf.5.xml:1122
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1749,7 +1758,7 @@ msgstr ""
 "etc/shells</quote>, использовать значение параметра shell_fallback."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1129 sssd.conf.5.xml:1127
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1758,14 +1767,14 @@ msgstr ""
 "shells</quote>, будет использована оболочка, которая не требует входа."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1134 sssd.conf.5.xml:1132
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 "Чтобы разрешить использование любой оболочки, можно использовать "
 "подстановочный знак (*)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1137 sssd.conf.5.xml:1135
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1776,12 +1785,12 @@ msgstr ""
 "ведение списка всех разрешённых оболочек в allowed_shells было бы излишним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1144 sssd.conf.5.xml:1142
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "Пустая строка оболочки передаётся libc «как есть»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1147 sssd.conf.5.xml:1145
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1790,28 +1799,28 @@ msgstr ""
 "Следовательно, в случае установки новой оболочки потребуется перезапуск SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1151 sssd.conf.5.xml:1149
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 "По умолчанию: не задано. Автоматически используется оболочка пользователя."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1156 sssd.conf.5.xml:1154
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1159 sssd.conf.5.xml:1157
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "Заменять все экземпляры этих оболочек на shell_fallback"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1164 sssd.conf.5.xml:1162
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1167 sssd.conf.5.xml:1165
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1819,17 +1828,17 @@ msgstr ""
 "оболочка не установлена на компьютере."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1171 sssd.conf.5.xml:1169
 msgid "Default: /bin/sh"
 msgstr "По умолчанию: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1176 sssd.conf.5.xml:1174
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1179 sssd.conf.5.xml:1177
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1839,7 +1848,7 @@ msgstr ""
 "разделе [nss] или для каждого домена отдельно."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1185 sssd.conf.5.xml:1183
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1848,12 +1857,14 @@ msgstr ""
 "положиться на libc в плане подстановки подходящего варианта, обычно /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575 sssd.conf.5.xml:1190
+#: sssd.conf.5.xml:1573
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578 sssd.conf.5.xml:1193
+#: sssd.conf.5.xml:1576
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1862,12 +1873,12 @@ msgstr ""
 "действительным."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1204 sssd.conf.5.xml:1202
 msgid "memcache_timeout (integer)"
 msgstr "memcache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1207 sssd.conf.5.xml:1205
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
@@ -1877,7 +1888,7 @@ msgstr ""
 "отключит кэш в памяти."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1215 sssd.conf.5.xml:1213
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
@@ -1888,7 +1899,9 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323 sssd.conf.5.xml:1219
+#: sssd.conf.5.xml:1244 sssd.conf.5.xml:1269 sssd.conf.5.xml:1294
+#: sssd.conf.5.xml:1321
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
@@ -1898,12 +1911,12 @@ msgstr ""
 "памяти."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1229 sssd.conf.5.xml:1227
 msgid "memcache_size_passwd (integer)"
 msgstr "memcache_size_passwd (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1232 sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1915,12 +1928,14 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:2982
 msgid "Default: 8"
 msgstr "По умолчанию: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1318 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1289 sssd.conf.5.xml:1316
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
@@ -1929,12 +1944,12 @@ msgstr ""
 "значительное негативное воздействие на производительность SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1254 sssd.conf.5.xml:1252
 msgid "memcache_size_group (integer)"
 msgstr "memcache_size_group (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1257 sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1947,17 +1962,18 @@ msgstr ""
 #. type: Content of: <variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
-#: include/krb5_options.xml:11
+#: include/krb5_options.xml:11 sssd.conf.5.xml:1261 sssd.conf.5.xml:1313
+#: sssd.conf.5.xml:3743
 msgid "Default: 6"
 msgstr "По умолчанию: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1279 sssd.conf.5.xml:1277
 msgid "memcache_size_initgroups (integer)"
 msgstr "memcache_size_initgroups (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1282 sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1968,12 +1984,12 @@ msgstr ""
 "отключит кэш в памяти для запросов групп инициализации."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1304 sssd.conf.5.xml:1302
 msgid "memcache_size_sid (integer)"
 msgstr "memcache_size_sid (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1307 sssd.conf.5.xml:1305
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1986,12 +2002,12 @@ msgstr ""
 "размера в значение «0» отключит кэш SID в памяти."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90 sssd.conf.5.xml:1329
 msgid "user_attributes (string)"
 msgstr "user_attributes (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1334 sssd.conf.5.xml:1332
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -2008,7 +2024,7 @@ msgstr ""
 "manvolnum> </citerefentry>), но без стандартных значений."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1347 sssd.conf.5.xml:1345
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
@@ -2017,17 +2033,17 @@ msgstr ""
 "ли он для ответчика NSS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1352 sssd.conf.5.xml:1350
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr "По умолчанию: не задано, использовать параметр InfoPipe"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1357 sssd.conf.5.xml:1355
 msgid "pwfield (string)"
 msgstr "pwfield (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1360 sssd.conf.5.xml:1358
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
@@ -2036,12 +2052,12 @@ msgstr ""
 "вернут для поля <quote>password</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1365 sssd.conf.5.xml:1363
 msgid "Default: <quote>*</quote>"
 msgstr "По умолчанию: <quote>*</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1368 sssd.conf.5.xml:1366
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
@@ -2050,7 +2066,7 @@ msgstr ""
 "что будет иметь приоритет над значением в разделе [nss]."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1370
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -2062,12 +2078,12 @@ msgstr ""
 "<quote>x</quote> (домен прокси с nss_files и целью sssd-shadowutils)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1384 sssd.conf.5.xml:1382
 msgid "PAM configuration options"
 msgstr "Параметры настройки PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1386 sssd.conf.5.xml:1384
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -2076,12 +2092,12 @@ msgstr ""
 "проверки подлинности (PAM)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1391 sssd.conf.5.xml:1389
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1394 sssd.conf.5.xml:1392
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -2091,17 +2107,18 @@ msgstr ""
 "момента последнего успешного входа)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412 sssd.conf.5.xml:1397
+#: sssd.conf.5.xml:1410
 msgid "Default: 0 (No limit)"
 msgstr "По умолчанию: 0 (без ограничений)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1403
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1408 sssd.conf.5.xml:1406
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -2110,12 +2127,12 @@ msgstr ""
 "режиме, сколько следует допускать неудачных попыток входа."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1418 sssd.conf.5.xml:1416
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1421 sssd.conf.5.xml:1419
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -2125,7 +2142,7 @@ msgstr ""
 "входа."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1426 sssd.conf.5.xml:1424
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -2137,17 +2154,18 @@ msgstr ""
 "возможной, необходимо успешно пройти проверку подлинности в сетевом режиме."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542 sssd.conf.5.xml:1430
+#: sssd.conf.5.xml:1540
 msgid "Default: 5"
 msgstr "По умолчанию: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1438 sssd.conf.5.xml:1436
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1441 sssd.conf.5.xml:1439
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -2156,43 +2174,43 @@ msgstr ""
 "подлинности. Чем больше число, тем больше сообщений будет показано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1446 sssd.conf.5.xml:1444
 msgid "Currently sssd supports the following values:"
 msgstr "В настоящее время sssd поддерживает следующие значения:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1449 sssd.conf.5.xml:1447
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: не показывать никаких сообщений"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1452 sssd.conf.5.xml:1450
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: показывать только важные сообщения"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1456 sssd.conf.5.xml:1454
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: показывать информационные сообщения"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1459 sssd.conf.5.xml:1457
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: показывать все сообщения и отладочную информацию"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1463 sssd.8.xml:63 sssd.conf.5.xml:1461
 msgid "Default: 1"
 msgstr "По умолчанию: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1469 sssd.conf.5.xml:1467
 msgid "pam_response_filter (string)"
 msgstr "pam_response_filter (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1472 sssd.conf.5.xml:1470
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2206,7 +2224,7 @@ msgstr ""
 "установлены pam_sss)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1480 sssd.conf.5.xml:1478
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
@@ -2215,37 +2233,37 @@ msgstr ""
 "параметр позволяет отфильтровать также и другие типы ответов."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1487 sssd.conf.5.xml:1485
 msgid "ENV"
 msgstr "ENV"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1488 sssd.conf.5.xml:1486
 msgid "Do not send any environment variables to any service."
 msgstr "Не отправлять никаким службам никакие переменные среды."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1491 sssd.conf.5.xml:1489
 msgid "ENV:var_name"
 msgstr "ENV:var_name"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1492 sssd.conf.5.xml:1490
 msgid "Do not send environment variable var_name to any service."
 msgstr "Не отправлять переменную среды var_name никаким службам."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1496 sssd.conf.5.xml:1494
 msgid "ENV:var_name:service"
 msgstr "ENV:var_name:service"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1497 sssd.conf.5.xml:1495
 msgid "Do not send environment variable var_name to service."
 msgstr "Не отправлять переменную среды var_name указанной службе."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1485 sssd.conf.5.xml:1483
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -2254,7 +2272,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1504 sssd.conf.5.xml:1502
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2272,23 +2290,23 @@ msgstr ""
 "префикса только для части элементов списка считается ошибкой."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1515 sssd.conf.5.xml:1513
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr "По умолчанию: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1518 sssd.conf.5.xml:1516
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr "Пример: -ENV:KRB5CCNAME:sudo-i удалит фильтр из списка стандартных"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1525 sssd.conf.5.xml:1523
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1528 sssd.conf.5.xml:1526
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2300,7 +2318,7 @@ msgstr ""
 "данные."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1534 sssd.conf.5.xml:1532
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2314,17 +2332,18 @@ msgstr ""
 "обменов данными с поставщиком данных идентификации."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1548 sssd.conf.5.xml:1546
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014 sssd.conf.5.xml:1549
+#: sssd.conf.5.xml:3006
 msgid "Display a warning N days before the password expires."
 msgstr "Показать предупреждение за N дней до истечения срока действия пароля."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1554 sssd.conf.5.xml:1552
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2335,7 +2354,8 @@ msgstr ""
 "сможет показать предупреждение."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017 sssd.conf.5.xml:1558
+#: sssd.conf.5.xml:3009
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2345,7 +2365,7 @@ msgstr ""
 "показано автоматически."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1565 sssd.conf.5.xml:1563
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2355,16 +2375,17 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1568 sssd.conf.5.xml:4009
 msgid "Default: 0"
 msgstr "По умолчанию: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1587 sssd.conf.5.xml:1585
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1590 sssd.conf.5.xml:1588
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2379,12 +2400,12 @@ msgstr ""
 "quote>. Имена пользователей разрешаются в UID при запуске."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1600 sssd.conf.5.xml:1598
 msgid "Default: All users are considered trusted by default"
 msgstr "По умолчанию: все пользователи считаются доверенными по умолчанию"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1604 sssd.conf.5.xml:1602
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
@@ -2393,12 +2414,12 @@ msgstr ""
 "если этот идентификатор пользователя отсутствует в списке pam_trusted_users."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1611 sssd.conf.5.xml:1609
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1614 sssd.conf.5.xml:1612
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
@@ -2407,12 +2428,12 @@ msgstr ""
 "недоверенных пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1618 sssd.conf.5.xml:1616
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr "Для параметра pam_public_domains определены два специальных значения:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1622 sssd.conf.5.xml:1620
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
@@ -2420,7 +2441,7 @@ msgstr ""
 "PAM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1626 sssd.conf.5.xml:1624
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2431,17 +2452,19 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
 #: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd-ldap.5.xml:1209 sssd.conf.5.xml:1628 sssd.conf.5.xml:1653
+#: sssd.conf.5.xml:1672 sssd.conf.5.xml:1909 sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:3938
 msgid "Default: none"
 msgstr "По умолчанию: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1635 sssd.conf.5.xml:1633
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1638 sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
@@ -2450,7 +2473,7 @@ msgstr ""
 "которое заменит стандартное сообщение «Доступ запрещён»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1643 sssd.conf.5.xml:1641
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
@@ -2460,7 +2483,7 @@ msgstr ""
 "«3» (показывать все сообщения и отладочную информацию)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1651 sssd.conf.5.xml:1649
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2470,12 +2493,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1660 sssd.conf.5.xml:1658
 msgid "pam_account_locked_message (string)"
 msgstr "pam_account_locked_message (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1663 sssd.conf.5.xml:1661
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
@@ -2484,7 +2507,7 @@ msgstr ""
 "стандартное сообщение «Доступ запрещён»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1670 sssd.conf.5.xml:1668
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2494,28 +2517,29 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1679 sssd.conf.5.xml:1677
 msgid "pam_passkey_auth (bool)"
 msgstr "pam_passkey_auth (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1682 sssd.conf.5.xml:1680
 msgid "Enable passkey device based authentication."
 msgstr "Включите аутентификацию на основе ключа доступа."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
-#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
+#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145 sssd.conf.5.xml:1683
+#: sssd.conf.5.xml:1995
 msgid "Default: True"
 msgstr "По умолчанию: true"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1690 sssd.conf.5.xml:1688
 msgid "passkey_debug_libfido2 (bool)"
 msgstr "passkey_debug_libfido2 (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1693 sssd.conf.5.xml:1691
 msgid "Enable libfido2 library debug messages."
 msgstr "Включить отладочные сообщения библиотеки libfido2."
 
@@ -2523,17 +2547,17 @@ msgstr "Включить отладочные сообщения библиот
 #: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
 #: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
 #: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
-#: include/ldap_id_mapping.xml:250
+#: include/ldap_id_mapping.xml:250 sssd.conf.5.xml:1694 sssd.conf.5.xml:1708
 msgid "Default: False"
 msgstr "По умолчанию: false"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1701 sssd.conf.5.xml:1699
 msgid "pam_cert_auth (bool)"
 msgstr "pam_cert_auth (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1704 sssd.conf.5.xml:1702
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2544,22 +2568,24 @@ msgstr ""
 "задержит процесс проверки подлинности, по умолчанию этот параметр отключён."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1715 sssd.conf.5.xml:1713
 msgid "pam_cert_db_path (string)"
 msgstr "pam_cert_db_path (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1718 sssd.conf.5.xml:1716
 msgid "The path to the certificate database."
 msgstr "Путь к базе данных сертификатов."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1719 sssd.conf.5.xml:2244 sssd.conf.5.xml:4430
 msgid "Default:"
 msgstr "По умолчанию:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248 sssd.conf.5.xml:1721
+#: sssd.conf.5.xml:2246
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
@@ -2568,12 +2594,12 @@ msgstr ""
 "CA в формате PEM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1733 sssd.conf.5.xml:1731
 msgid "pam_cert_verification (string)"
 msgstr "pam_cert_verification (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1736 sssd.conf.5.xml:1734
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2588,7 +2614,7 @@ msgstr ""
 "<quote>certificate_verification</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1747 sssd.conf.5.xml:1745
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2598,7 +2624,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1751 sssd.conf.5.xml:1749
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
@@ -2608,24 +2634,24 @@ msgstr ""
 "quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1758 sssd.conf.5.xml:1756
 msgid "p11_child_timeout (integer)"
 msgstr "p11_child_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1761 sssd.conf.5.xml:1759
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 "Разрешённое количество секунд, в течение которого pam_sss ожидает завершения "
 "работы p11_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1770 sssd.conf.5.xml:1768
 msgid "passkey_child_timeout (integer)"
 msgstr "passkey_child_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1773 sssd.conf.5.xml:1771
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
@@ -2633,12 +2659,12 @@ msgstr ""
 "завершения работы passkey_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1782 sssd.conf.5.xml:1780
 msgid "pam_app_services (string)"
 msgstr "pam_app_services (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1785 sssd.conf.5.xml:1783
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
@@ -2647,12 +2673,12 @@ msgstr ""
 "типа <quote>application</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1794 sssd.conf.5.xml:1792
 msgid "pam_p11_allowed_services (string)"
 msgstr "pam_p11_allowed_services (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1797 sssd.conf.5.xml:1795
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
@@ -2661,7 +2687,7 @@ msgstr ""
 "использовать смарт-карты."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1812 sssd.conf.5.xml:1810
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2671,7 +2697,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1801 sssd.conf.5.xml:1799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2691,62 +2717,62 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd-ad.5.xml:869 sssd-ad.5.xml:947 sssd.conf.5.xml:1814
 msgid "Default: the default set of PAM service names includes:"
 msgstr "По умолчанию: стандартный набор имён служб PAM включает:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648 sssd.conf.5.xml:1819
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653 sssd.conf.5.xml:1824
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658 sssd.conf.5.xml:1829
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673 sssd.conf.5.xml:1834
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668 sssd.conf.5.xml:1839
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678 sssd.conf.5.xml:1844
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956 sssd.conf.5.xml:1849
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961 sssd.conf.5.xml:1854
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1861 sssd.conf.5.xml:1859
 msgid "gnome-screensaver"
 msgstr "gnome-screensaver"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1869 sssd.conf.5.xml:1867
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1872 sssd.conf.5.xml:1870
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2757,12 +2783,12 @@ msgstr ""
 "p11_child_timeout) ответчик PAM должен ожидать вставки смарт-карты."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1883 sssd.conf.5.xml:1881
 msgid "p11_uri (string)"
 msgstr "p11_uri (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1886 sssd.conf.5.xml:1884
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2780,7 +2806,7 @@ msgstr ""
 "чтения."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1899 sssd.conf.5.xml:1897
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2790,7 +2816,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1903 sssd.conf.5.xml:1901
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2800,7 +2826,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1897 sssd.conf.5.xml:1895
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2814,17 +2840,17 @@ msgstr ""
 "URI PKCS#11."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1916 sssd.conf.5.xml:1914
 msgid "pam_initgroups_scheme"
 msgstr "pam_initgroups_scheme"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1924 sssd.conf.5.xml:1922
 msgid "always"
 msgstr "always"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1925 sssd.conf.5.xml:1923
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
@@ -2832,12 +2858,12 @@ msgstr ""
 "pam_id_timeout всё равно применяется)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1929 sssd.conf.5.xml:1927
 msgid "no_session"
 msgstr "no_session"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1930 sssd.conf.5.xml:1928
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
@@ -2846,12 +2872,12 @@ msgstr ""
 "то есть тогда, когда пользователь не находится в системе"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1935 sssd.conf.5.xml:1933
 msgid "never"
 msgstr "never"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1936 sssd.conf.5.xml:1934
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
@@ -2860,7 +2886,7 @@ msgstr ""
 "до тех пор, пока они не устареют"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1919 sssd.conf.5.xml:1917
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2873,17 +2899,18 @@ msgstr ""
 "допустимые значения: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1943 sssd.conf.5.xml:1941
 msgid "Default: no_session"
 msgstr "По умолчанию: no_session"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377 sssd.conf.5.xml:1946
+#: sssd.conf.5.xml:4369
 msgid "pam_gssapi_services"
 msgstr "pam_gssapi_services"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1951 sssd.conf.5.xml:1949
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
@@ -2892,7 +2919,7 @@ msgstr ""
 "проверку подлинности по GSSAPI с помощью модуля pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1956 sssd.conf.5.xml:1954
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
@@ -2901,6 +2928,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1958 sssd.conf.5.xml:1989 sssd.conf.5.xml:2027
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2912,7 +2940,7 @@ msgstr ""
 "в разделе домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1968 sssd.conf.5.xml:1966
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2922,22 +2950,24 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940 sssd.conf.5.xml:1964
+#: sssd.conf.5.xml:3932
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Пример: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1972 sssd.conf.5.xml:1970
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr "По умолчанию: - (проверка подлинности с помощью GSSAPI отключена)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378 sssd.conf.5.xml:1975
+#: sssd.conf.5.xml:4370
 msgid "pam_gssapi_check_upn"
 msgstr "pam_gssapi_check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1980 sssd.conf.5.xml:1978
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2949,7 +2979,7 @@ msgstr ""
 "такой привязки нет, проверка подлинности завершится ошибкой."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1987 sssd.conf.5.xml:1985
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
@@ -2958,12 +2988,12 @@ msgstr ""
 "пользователей, получивших необходимый билет службы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:2002 sssd.conf.5.xml:2000
 msgid "pam_gssapi_indicators_map"
 msgstr "pam_gssapi_indicators_map"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:2005 sssd.conf.5.xml:2003
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2975,7 +3005,7 @@ msgstr ""
 "pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:2011 sssd.conf.5.xml:2009
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -3002,7 +3032,7 @@ msgstr ""
 "доступ."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:2024 sssd.conf.5.xml:2022
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -3014,7 +3044,7 @@ msgstr ""
 "<quote>service:-</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2035 sssd.conf.5.xml:2033
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
@@ -3023,7 +3053,7 @@ msgstr ""
 "индикаторов проверки подлинности:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2038 sssd.conf.5.xml:2036
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
@@ -3032,7 +3062,7 @@ msgstr ""
 "которые хранятся в файлах или на смарт-картах."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2041 sssd.conf.5.xml:2039
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
@@ -3041,13 +3071,13 @@ msgstr ""
 "предварительная проверка подлинности, помещённая в канал FAST."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2044 sssd.conf.5.xml:2042
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 "radius — предварительная проверка подлинности с помощью сервера RADIUS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2047 sssd.conf.5.xml:2045
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
@@ -3056,14 +3086,14 @@ msgstr ""
 "двухфакторной аутентификации (2FA или одноразовый пароль, OTP) в IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2050 sssd.conf.5.xml:2048
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 "idp -- предварительная аутентификация с использованием внешнего поставщика "
 "удостоверений."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2060 sssd.conf.5.xml:2058
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -3073,7 +3103,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2055 sssd.conf.5.xml:2053
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -3085,19 +3115,19 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2064 sssd.conf.5.xml:2062
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 "По умолчанию: не задано (использование индикаторов проверки подлинности не "
 "требуется)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2070
 msgid "SUDO configuration options"
 msgstr "Параметры настройки SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2074 sssd.conf.5.xml:2072
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -3114,12 +3144,12 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2091 sssd.conf.5.xml:2089
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2094 sssd.conf.5.xml:2092
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -3128,12 +3158,12 @@ msgstr ""
 "предназначенные для определения временных ограничений для записей sudoers."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2106 sssd.conf.5.xml:2104
 msgid "sudo_threshold (integer)"
 msgstr "sudo_threshold (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2109 sssd.conf.5.xml:2107
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -3149,22 +3179,22 @@ msgstr ""
 "к поискам команд и групп команд sudo IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2128 sssd.conf.5.xml:2126
 msgid "AUTOFS configuration options"
 msgstr "Параметры настройки AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2130 sssd.conf.5.xml:2128
 msgid "These options can be used to configure the autofs service."
 msgstr "Эти параметры можно использовать для настройки службы autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2134 sssd.conf.5.xml:2132
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2137 sssd.conf.5.xml:2135
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -3175,22 +3205,22 @@ msgstr ""
 "например, несуществующих) перед повторным запросом к внутреннему серверу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2153 sssd.conf.5.xml:2151
 msgid "SSH configuration options"
 msgstr "Параметры настройки SSH"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2155 sssd.conf.5.xml:2153
 msgid "These options can be used to configure the SSH service."
 msgstr "Эти параметры можно использовать для настройки службы SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2159 sssd.conf.5.xml:2157
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2162 sssd.conf.5.xml:2160
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -3198,12 +3228,12 @@ msgstr ""
 "Следует ли хэшировать имена и адреса узлов в управляемом файле known_hosts."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2171 sssd.conf.5.xml:2169
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2174 sssd.conf.5.xml:2172
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -3212,17 +3242,17 @@ msgstr ""
 "управляемом файле known_hosts после запроса ключей этого узла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2178 sssd.conf.5.xml:2176
 msgid "Default: 180"
 msgstr "По умолчанию: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2183 sssd.conf.5.xml:2181
 msgid "ssh_use_certificate_keys (bool)"
 msgstr "ssh_use_certificate_keys (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2186 sssd.conf.5.xml:2184
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -3236,12 +3266,12 @@ msgstr ""
 "<manvolnum>1</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2201 sssd.conf.5.xml:2199
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr "ssh_use_certificate_matching_rules (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2204 sssd.conf.5.xml:2202
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -3257,7 +3287,7 @@ msgstr ""
 "другие правила будут игнорироваться."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2213 sssd.conf.5.xml:2211
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -3269,7 +3299,7 @@ msgstr ""
 "ключи SSH будут создаваться на основе всех действительных сертификатов."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2220 sssd.conf.5.xml:2218
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -3283,7 +3313,7 @@ msgstr ""
 "подлинности сертификатов."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2227 sssd.conf.5.xml:2225
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
@@ -3292,7 +3322,7 @@ msgstr ""
 "выбрано ни одного правила, все сертификаты будут проигнорированы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2232 sssd.conf.5.xml:2230
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
@@ -3301,12 +3331,12 @@ msgstr ""
 "правила или правило по умолчанию"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2238 sssd.conf.5.xml:2236
 msgid "ca_db (string)"
 msgstr "ca_db (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2241 sssd.conf.5.xml:2239
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
@@ -3316,12 +3346,12 @@ msgstr ""
 "SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2261 sssd.conf.5.xml:2259
 msgid "PAC responder configuration options"
 msgstr "Параметры настройки ответчика PAC"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2263 sssd.conf.5.xml:2261
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -3339,7 +3369,7 @@ msgstr ""
 "обрабатывается, выполняются некоторые из следующих операций:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2272 sssd.conf.5.xml:2270
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -3356,7 +3386,7 @@ msgstr ""
 "можно переопределить с помощью параметра default_shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2280 sssd.conf.5.xml:2278
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3365,17 +3395,17 @@ msgstr ""
 "добавлен в эти группы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2286 sssd.conf.5.xml:2284
 msgid "These options can be used to configure the PAC responder."
 msgstr "Эти параметры можно использовать для настройки ответчика PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66 sssd.conf.5.xml:2288
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2293 sssd.conf.5.xml:2291
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3386,7 +3416,7 @@ msgstr ""
 "запуске."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2299 sssd.conf.5.xml:2297
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
@@ -3395,13 +3425,13 @@ msgstr ""
 "root и пользователям службы SSSD)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2303 sssd.conf.5.xml:2301
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "По умолчанию: 0 (доступ к ответчику PAC разрешён только пользователю root)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2307 sssd.conf.5.xml:2305
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -3414,7 +3444,7 @@ msgstr ""
 "случай), необходимо явно добавить их в список разрешенных UID."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2314 sssd.conf.5.xml:2312
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3428,12 +3458,12 @@ msgstr ""
 "доступ."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2323 sssd.conf.5.xml:2321
 msgid "pac_lifetime (integer)"
 msgstr "pac_lifetime (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2326 sssd.conf.5.xml:2324
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
@@ -3442,12 +3472,12 @@ msgstr ""
 "PAC можно использовать для определения участия пользователя в группах."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2336 sssd.conf.5.xml:2334
 msgid "pac_check (string)"
 msgstr "pac_check (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2339 sssd.conf.5.xml:2337
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3465,12 +3495,12 @@ msgstr ""
 "пропущена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2353 sssd.conf.5.xml:2351
 msgid "no_check"
 msgstr "no_check"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2355 sssd.conf.5.xml:2353
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
@@ -3479,12 +3509,12 @@ msgstr ""
 "проверки выполняться не будут."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2361 sssd.conf.5.xml:2359
 msgid "pac_present"
 msgstr "pac_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2363 sssd.conf.5.xml:2361
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3495,12 +3525,12 @@ msgstr ""
 "ошибкой."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2371 sssd.conf.5.xml:2369
 msgid "check_upn"
 msgstr "check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2373 sssd.conf.5.xml:2371
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
@@ -3509,12 +3539,12 @@ msgstr ""
 "пользователя (UPN) верна."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2379 sssd.conf.5.xml:2377
 msgid "check_upn_allow_missing"
 msgstr "check_upn_allow_missing"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2381 sssd.conf.5.xml:2379
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3534,7 +3564,7 @@ msgstr ""
 "устанавливать 'ldap_user_principal'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2393 sssd.conf.5.xml:2391
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3551,24 +3581,24 @@ msgstr ""
 "пропуску проверки и сообщение не появится в журнале."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2407 sssd.conf.5.xml:2405
 msgid "upn_dns_info_present"
 msgstr "upn_dns_info_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2409 sssd.conf.5.xml:2407
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 "PAC должен содержать буфер UPN-DNS-INFO, неявным образом устанавливает "
 "'check_upn'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2414 sssd.conf.5.xml:2412
 msgid "check_upn_dns_info_ex"
 msgstr "check_upn_dns_info_ex"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2416 sssd.conf.5.xml:2414
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
@@ -3577,12 +3607,12 @@ msgstr ""
 "согласованы ли данные в расширении."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2423 sssd.conf.5.xml:2421
 msgid "upn_dns_info_ex_present"
 msgstr "upn_dns_info_ex_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2425 sssd.conf.5.xml:2423
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
@@ -3591,7 +3621,7 @@ msgstr ""
 "устанавливает 'check_upn_dns_info_ex', 'upn_dns_info_present' и 'check_upn'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2349 sssd.conf.5.xml:2347
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3600,7 +3630,7 @@ msgstr ""
 "запятыми списка: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2435 sssd.conf.5.xml:2433
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
@@ -3609,12 +3639,12 @@ msgstr ""
 "check_upn_allow_missing, check_upn_dns_info_ex')"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2444 sssd.conf.5.xml:2442
 msgid "Session recording configuration options"
 msgstr "Параметры настройки записи сеансов"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2446 sssd.conf.5.xml:2444
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3630,32 +3660,32 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2459 sssd.conf.5.xml:2457
 msgid "These options can be used to configure session recording."
 msgstr "Эти параметры можно использовать для настройки записи сеансов."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64 sssd.conf.5.xml:2461
 msgid "scope (string)"
 msgstr "scope (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71 sssd.conf.5.xml:2468
 msgid "\"none\""
 msgstr "«none»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74 sssd.conf.5.xml:2471
 msgid "No users are recorded."
 msgstr "Пользователи не записываются."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79 sssd.conf.5.xml:2476
 msgid "\"some\""
 msgstr "«some»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82 sssd.conf.5.xml:2479
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
@@ -3664,17 +3694,17 @@ msgstr ""
 "<replaceable>users</replaceable> и <replaceable>groups</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91 sssd.conf.5.xml:2488
 msgid "\"all\""
 msgstr "«all»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94 sssd.conf.5.xml:2491
 msgid "All users are recorded."
 msgstr "Записываются все пользователи."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67 sssd.conf.5.xml:2464
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3683,17 +3713,17 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101 sssd.conf.5.xml:2498
 msgid "Default: \"none\""
 msgstr "По умолчанию: «none»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106 sssd.conf.5.xml:2503
 msgid "users (string)"
 msgstr "users (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109 sssd.conf.5.xml:2506
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3705,17 +3735,17 @@ msgstr ""
 "так далее."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115 sssd.conf.5.xml:2512
 msgid "Default: Empty. Matches no users."
 msgstr "По умолчанию: пусто. Не соответствует ни одному пользователю."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120 sssd.conf.5.xml:2517
 msgid "groups (string)"
 msgstr "groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123 sssd.conf.5.xml:2520
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3727,7 +3757,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
-#: sssd-session-recording.5.xml:161
+#: sssd-session-recording.5.xml:161 sssd.conf.5.xml:2526 sssd.conf.5.xml:2558
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
 "performance cost, because each uncached request for a user requires "
@@ -3739,17 +3769,17 @@ msgstr ""
 "установление соответствия групп, участником которых он является."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136 sssd.conf.5.xml:2533
 msgid "Default: Empty. Matches no groups."
 msgstr "По умолчанию: пусто. Не соответствует ни одной группе."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141 sssd.conf.5.xml:2538
 msgid "exclude_users (string)"
 msgstr "exclude_users (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144 sssd.conf.5.xml:2541
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
@@ -3758,17 +3788,17 @@ msgstr ""
 "применимо только при «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148 sssd.conf.5.xml:2545
 msgid "Default: Empty. No users excluded."
 msgstr "По умолчанию: пусто. Не исключается ни один пользователь."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153 sssd.conf.5.xml:2550
 msgid "exclude_groups (string)"
 msgstr "exclude_groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156 sssd.conf.5.xml:2553
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
@@ -3777,23 +3807,24 @@ msgstr ""
 "применимо только при «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168 sssd.conf.5.xml:2565
 msgid "Default: Empty. No groups excluded."
 msgstr "По умолчанию: пусто. Не исключается ни одна группа."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2577 sssd.conf.5.xml:2575
 msgid "DOMAIN SECTIONS"
 msgstr "РАЗДЕЛЫ ДОМЕНА"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
 #: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:4072 sssd.conf.5.xml:2582 sssd.conf.5.xml:4060
+#: sssd.conf.5.xml:4061 sssd.conf.5.xml:4064
 msgid "enabled"
 msgstr "enabled"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2587 sssd.conf.5.xml:2585
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3808,12 +3839,12 @@ msgstr ""
 "параметра domains в разделе <quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2599 sssd.conf.5.xml:2597
 msgid "domain_type (string)"
 msgstr "domain_type (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2602 sssd.conf.5.xml:2600
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3826,7 +3857,7 @@ msgstr ""
 "операционной системы доступны только объекты из доменов POSIX."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2610 sssd.conf.5.xml:2608
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
@@ -3835,7 +3866,7 @@ msgstr ""
 "<quote>application</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2614 sssd.conf.5.xml:2612
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3847,7 +3878,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) и ответчика PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2622 sssd.conf.5.xml:2620
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
@@ -3856,7 +3887,7 @@ msgstr ""
 "с <quote>id_provider=ldap</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2626 sssd.conf.5.xml:2624
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
@@ -3865,17 +3896,17 @@ msgstr ""
 "<quote>Домены приложений</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2630 sssd.conf.5.xml:2628
 msgid "Default: posix"
 msgstr "По умолчанию: posix"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2636 sssd.conf.5.xml:2634
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2639 sssd.conf.5.xml:2637
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3884,7 +3915,7 @@ msgstr ""
 "находящуюся вне указанного диапазона, она будет проигнорирована."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2644 sssd.conf.5.xml:2642
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3898,7 +3929,7 @@ msgstr ""
 "группы, будут выведены в обычном режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2649
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3907,17 +3938,17 @@ msgstr ""
 "кэш, а не только на их возврат по имени или идентификатору."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2655 sssd.conf.5.xml:2653
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "По умолчанию: 1 для min_id, 0 (без ограничений) для max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2661 sssd.conf.5.xml:2659
 msgid "enumerate (bool)"
 msgstr "enumerate (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2664 sssd.conf.5.xml:2662
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3930,22 +3961,23 @@ msgstr ""
 "вторичных групп. Этот параметр может иметь одно из следующих значений:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2672 sssd.conf.5.xml:2670
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = пользователи и группы перечисляются"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2675 sssd.conf.5.xml:2673
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = для этого домена не выполняется перечисление"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2676 sssd.conf.5.xml:2961 sssd.conf.5.xml:3138
 msgid "Default: FALSE"
 msgstr "По умолчанию: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2681 sssd.conf.5.xml:2679
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
@@ -3955,15 +3987,15 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2686
-#, fuzzy
-#| msgid "Feature is only supported for domains with id_provider = ldap."
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
-msgstr "Функция поддерживается только для доменов с id_provider = ldap."
+msgstr ""
+"Функция поддерживается только для доменов с id_provider = ldap или "
+"id_provider = proxy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2690 sssd.conf.5.xml:2688
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3987,7 +4019,7 @@ msgstr ""
 "перезапущен внутренним сторожевым таймером."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2705 sssd.conf.5.xml:2703
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3996,7 +4028,7 @@ msgstr ""
 "или групп могут не вернуть результатов до момента завершения перечисления."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2710 sssd.conf.5.xml:2708
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -4010,7 +4042,7 @@ msgstr ""
 "идентификаторов (id_provider)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2718 sssd.conf.5.xml:2716
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -4025,34 +4057,38 @@ msgid ""
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
 "documented behavior of nss modules to be used in this configuration."
 msgstr ""
+"Примечание: прокси-провайдер тестируется с открытыми модулями, такими как "
+"«libnss_files» и «libnss_ldap». Сторонние модули должны соответствовать "
+"документированному поведению модулей nss, которые будут использоваться в "
+"этой конфигурации."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2732 sssd.conf.5.xml:2724
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2739 sssd.conf.5.xml:2731
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2740 sssd.conf.5.xml:2732
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Выполнить перечисление для всех обнаруженных доверенных доменов"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2743 sssd.conf.5.xml:2735
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2744 sssd.conf.5.xml:2736
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Не выполнять перечисление для обнаруженных доверенных доменов"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2735 sssd.conf.5.xml:2727
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -4066,12 +4102,12 @@ msgstr ""
 "только для них."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2758 sssd.conf.5.xml:2750
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2761 sssd.conf.5.xml:2753
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -4080,7 +4116,7 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2765 sssd.conf.5.xml:2757
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -4097,17 +4133,17 @@ msgstr ""
 "уже были кэшированы."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2778 sssd.conf.5.xml:2770
 msgid "Default: 5400"
 msgstr "По умолчанию: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2784 sssd.conf.5.xml:2776
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2787 sssd.conf.5.xml:2779
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -4120,16 +4156,19 @@ msgstr ""
 #: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
 #: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
 #: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2783 sssd.conf.5.xml:2796 sssd.conf.5.xml:2809
+#: sssd.conf.5.xml:2822 sssd.conf.5.xml:2836 sssd.conf.5.xml:2849
+#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2877 sssd.conf.5.xml:2890
 msgid "Default: entry_cache_timeout"
 msgstr "По умолчанию: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2797 sssd.conf.5.xml:2789
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2800 sssd.conf.5.xml:2792
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -4138,12 +4177,12 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2810 sssd.conf.5.xml:2802
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2813 sssd.conf.5.xml:2805
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -4152,12 +4191,12 @@ msgstr ""
 "групп действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2823 sssd.conf.5.xml:2815
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2826 sssd.conf.5.xml:2818
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -4166,12 +4205,12 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2836 sssd.conf.5.xml:2828
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr "entry_cache_resolver_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2839 sssd.conf.5.xml:2831
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
@@ -4180,12 +4219,12 @@ msgstr ""
 "сетей действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2850 sssd.conf.5.xml:2842
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2853 sssd.conf.5.xml:2845
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -4194,12 +4233,12 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2855
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2866 sssd.conf.5.xml:2858
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -4209,12 +4248,12 @@ msgstr ""
 "внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2877 sssd.conf.5.xml:2869
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2880 sssd.conf.5.xml:2872
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -4224,12 +4263,12 @@ msgstr ""
 "узла в кэше."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2891 sssd.conf.5.xml:2883
 msgid "entry_cache_computer_timeout (integer)"
 msgstr "entry_cache_computer_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2894 sssd.conf.5.xml:2886
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
@@ -4238,12 +4277,12 @@ msgstr ""
 "компьютера, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2904 sssd.conf.5.xml:2896
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2907 sssd.conf.5.xml:2899
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -4252,7 +4291,7 @@ msgstr ""
 "обновления всех устаревших или почти устаревших записей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2912 sssd.conf.5.xml:2904
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -4266,18 +4305,18 @@ msgstr ""
 "пользователя в группах, обычно выполняется при запуске)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2920 sssd.conf.5.xml:2912
 msgid "This option is automatically inherited for all trusted domains."
 msgstr "Этот параметр автоматически наследуется для всех доверенных доменов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2924 sssd.conf.5.xml:2916
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 "Рекомендуется установить это значение равным 3/4 * entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2928 sssd.conf.5.xml:2920
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -4299,17 +4338,17 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
-#: sssd-ipa.5.xml:270
+#: sssd-ipa.5.xml:270 sssd.conf.5.xml:2933
 msgid "Default: 0 (disabled)"
 msgstr "По умолчанию: 0 (отключено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2947 sssd.conf.5.xml:2939
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2950 sssd.conf.5.xml:2942
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -4326,7 +4365,7 @@ msgstr ""
 "аутентификация записывается в кэш без дополнительной настройки."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2961 sssd.conf.5.xml:2953
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -4340,12 +4379,12 @@ msgstr ""
 "пароль с помощью атаки грубой силы."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2975 sssd.conf.5.xml:2967
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr "cache_credentials_minimal_first_factor_length (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2978 sssd.conf.5.xml:2970
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -4357,7 +4396,7 @@ msgstr ""
 "сохранён в формате контрольной суммы SHA512 в кэше."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2985 sssd.conf.5.xml:2977
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
@@ -4367,12 +4406,12 @@ msgstr ""
 "мишенью для атак методом подбора."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2996 sssd.conf.5.xml:2988
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2999 sssd.conf.5.xml:2991
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -4385,17 +4424,17 @@ msgstr ""
 "быть больше или равно значению offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:3006 sssd.conf.5.xml:2998
 msgid "Default: 0 (unlimited)"
 msgstr "По умолчанию: 0 (без ограничений)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:3011 sssd.conf.5.xml:3003
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:3022 sssd.conf.5.xml:3014
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -4408,17 +4447,17 @@ msgstr ""
 "настроить поставщика данных проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3029 sssd.conf.5.xml:3021
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "По умолчанию: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3035 sssd.conf.5.xml:3027
 msgid "id_provider (string)"
 msgstr "id_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3038 sssd.conf.5.xml:3030
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -4426,12 +4465,12 @@ msgstr ""
 "Поддерживаемые поставщики ID:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3042 sssd.conf.5.xml:3034
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr "<quote>proxy</quote>: поддержка устаревшего поставщика NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3045 sssd.conf.5.xml:3037
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4443,7 +4482,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3053 sssd.conf.5.xml:3045
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4455,7 +4494,8 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3286 sssd.conf.5.xml:3053 sssd.conf.5.xml:3164
+#: sssd.conf.5.xml:3215 sssd.conf.5.xml:3278
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4468,7 +4508,8 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3295 sssd.conf.5.xml:3062 sssd.conf.5.xml:3173
+#: sssd.conf.5.xml:3224 sssd.conf.5.xml:3287
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4479,12 +4520,12 @@ msgstr ""
 "ad</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3081 sssd.conf.5.xml:3073
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3084 sssd.conf.5.xml:3076
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4493,7 +4534,7 @@ msgstr ""
 "домена) в качестве имени для входа пользователя, которое сообщается NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3089 sssd.conf.5.xml:3081
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4507,7 +4548,7 @@ msgstr ""
 "passwd test@LOCAL</command> получится это сделать."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3097 sssd.conf.5.xml:3089
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4518,7 +4559,7 @@ msgstr ""
 "групп выполняется поиск во всех доменах, когда запрашивается неполное имя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3104 sssd.conf.5.xml:3096
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
@@ -4527,17 +4568,17 @@ msgstr ""
 "использования default_domain_suffix)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3111 sssd.conf.5.xml:3103
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3106
 msgid "Do not return group members for group lookups."
 msgstr "Не возвращать участников групп для поиска групп."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3117 sssd.conf.5.xml:3109
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4556,7 +4597,7 @@ msgstr ""
 "запрошенную группу так, как будто она пуста."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3135 sssd.conf.5.xml:3127
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4571,7 +4612,8 @@ msgstr ""
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086 sssd.conf.5.xml:3133
+#: sssd.conf.5.xml:3854
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
@@ -4580,12 +4622,12 @@ msgstr ""
 "унаследован с помощью <emphasis>subdomain_inherit</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3151 sssd.conf.5.xml:3143
 msgid "auth_provider (string)"
 msgstr "auth_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3154 sssd.conf.5.xml:3146
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4594,7 +4636,8 @@ msgstr ""
 "Поддерживаемые поставщики данных для проверки подлинности:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216 sssd.conf.5.xml:3150
+#: sssd.conf.5.xml:3208
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4605,7 +4648,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3165 sssd.conf.5.xml:3157
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4617,7 +4660,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3189 sssd.conf.5.xml:3181
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
@@ -4625,12 +4668,12 @@ msgstr ""
 "PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3192 sssd.conf.5.xml:3184
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> — явно отключить проверку подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3195 sssd.conf.5.xml:3187
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4639,12 +4682,12 @@ msgstr ""
 "задан и поддерживает обработку запросов проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3201 sssd.conf.5.xml:3193
 msgid "access_provider (string)"
 msgstr "access_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3204 sssd.conf.5.xml:3196
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4655,7 +4698,7 @@ msgstr ""
 "включены в установленные внутренние серверы). Внутренние особые поставщики:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3210 sssd.conf.5.xml:3202
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4664,12 +4707,12 @@ msgstr ""
 "разрешённого доступа для локального домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3213 sssd.conf.5.xml:3205
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> — всегда отказывать в доступе."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3240 sssd.conf.5.xml:3232
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4682,7 +4725,7 @@ msgstr ""
 "<manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3247 sssd.conf.5.xml:3239
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4693,23 +4736,23 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3254 sssd.conf.5.xml:3246
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 "<quote>proxy</quote> — передать управление доступом другому модулю PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3257 sssd.conf.5.xml:3249
 msgid "Default: <quote>permit</quote>"
 msgstr "По умолчанию: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3262 sssd.conf.5.xml:3254
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3265 sssd.conf.5.xml:3257
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4718,7 +4761,7 @@ msgstr ""
 "домена. Поддерживаемые поставщики данных смены пароля:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3270 sssd.conf.5.xml:3262
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4729,7 +4772,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3278 sssd.conf.5.xml:3270
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4740,19 +4783,19 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3303 sssd.conf.5.xml:3295
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 "<quote>proxy</quote> — передать смену пароля какой-либо другой цели PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3307 sssd.conf.5.xml:3299
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> — явно запретить смену пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3310 sssd.conf.5.xml:3302
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4761,19 +4804,19 @@ msgstr ""
 "задан и поддерживает обработку запросов смены пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3317 sssd.conf.5.xml:3309
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3320 sssd.conf.5.xml:3312
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "Поставщик данных SUDO, который используется для домена. Поддерживаемые "
 "поставщики данных SUDO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3324 sssd.conf.5.xml:3316
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4784,7 +4827,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3332 sssd.conf.5.xml:3324
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4793,7 +4836,7 @@ msgstr ""
 "параметрами IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3336 sssd.conf.5.xml:3328
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4802,20 +4845,22 @@ msgstr ""
 "параметрами AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3340 sssd.conf.5.xml:3332
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> — явно отключить SUDO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555 sssd.conf.5.xml:3335
+#: sssd.conf.5.xml:3421 sssd.conf.5.xml:3486 sssd.conf.5.xml:3511
+#: sssd.conf.5.xml:3547
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "По умолчанию: использовать значение <quote>id_provider</quote>, если этот "
 "параметр задан."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3347 sssd.conf.5.xml:3339
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4833,7 +4878,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3362 sssd.conf.5.xml:3354
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4847,12 +4892,12 @@ msgstr ""
 "планируется использовать sudo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3372 sssd.conf.5.xml:3364
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3375 sssd.conf.5.xml:3367
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4863,7 +4908,7 @@ msgstr ""
 "работы поставщика доступа. Поддерживаемые поставщики данных SELinux:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3381 sssd.conf.5.xml:3373
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4874,12 +4919,12 @@ msgstr ""
 "ipa</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3389 sssd.conf.5.xml:3381
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr "<quote>none</quote> — явно отключает получение параметров SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3392 sssd.conf.5.xml:3384
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4888,12 +4933,12 @@ msgstr ""
 "задан и поддерживает обработку запросов загрузки параметров SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3398 sssd.conf.5.xml:3390
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3401 sssd.conf.5.xml:3393
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4903,7 +4948,7 @@ msgstr ""
 "Поддерживаемые поставщики данных поддоменов:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3407 sssd.conf.5.xml:3399
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4914,7 +4959,7 @@ msgstr ""
 "ipa</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3416 sssd.conf.5.xml:3408
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4927,17 +4972,17 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3425 sssd.conf.5.xml:3417
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "<quote>none</quote> — явно отключает получение данных поддоменов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3435 sssd.conf.5.xml:3427
 msgid "session_provider (string)"
 msgstr "session_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3438 sssd.conf.5.xml:3430
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4949,14 +4994,14 @@ msgstr ""
 "Commander (работает только c IPA). Поддерживаемые поставщики данных сеансов:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3445 sssd.conf.5.xml:3437
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 "<quote>ipa</quote> — разрешить выполнение заданий, связанных с сеансами "
 "пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3449 sssd.conf.5.xml:3441
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
@@ -4964,7 +5009,7 @@ msgstr ""
 "пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3453 sssd.conf.5.xml:3445
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
@@ -4973,12 +5018,12 @@ msgstr ""
 "задан и поддерживает выполнение заданий, связанных с сеансами."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3460 sssd.conf.5.xml:3452
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3463 sssd.conf.5.xml:3455
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -4986,7 +5031,7 @@ msgstr ""
 "поставщики данных autofs:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3467 sssd.conf.5.xml:3459
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4997,7 +5042,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3474 sssd.conf.5.xml:3466
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5008,7 +5053,7 @@ msgstr ""
 "ipa</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3482 sssd.conf.5.xml:3474
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5020,17 +5065,17 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3491 sssd.conf.5.xml:3483
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> — явно отключить autofs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3501 sssd.conf.5.xml:3493
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3504 sssd.conf.5.xml:3496
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -5039,7 +5084,7 @@ msgstr ""
 "узла. Поддерживаемые поставщики hostid:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3508 sssd.conf.5.xml:3500
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -5051,17 +5096,17 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3516 sssd.conf.5.xml:3508
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> — явно отключить hostid."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3526 sssd.conf.5.xml:3518
 msgid "resolver_provider (string)"
 msgstr "resolver_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3529 sssd.conf.5.xml:3521
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
@@ -5070,7 +5115,7 @@ msgstr ""
 "Поддерживаемые поставщики данных сопоставления:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3533 sssd.conf.5.xml:3525
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
@@ -5079,7 +5124,7 @@ msgstr ""
 "NSS. См. <quote>proxy_resolver_lib_name</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3537 sssd.conf.5.xml:3529
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -5091,7 +5136,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3544 sssd.conf.5.xml:3536
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -5104,12 +5149,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3544
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr "<quote>none</quote> — явно отключает получение записей узлов и сетей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3565 sssd.conf.5.xml:3557
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -5124,7 +5169,7 @@ msgstr ""
 "домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3574 sssd.conf.5.xml:3566
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
@@ -5134,17 +5179,19 @@ msgstr ""
 "пользователей:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593 sssd.conf.5.xml:3571
+#: sssd.conf.5.xml:3585
 msgid "username"
 msgstr "username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596 sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3588
 msgid "username@domain.name"
 msgstr "username@domain.name"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3587 sssd.conf.5.xml:3579
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -5157,12 +5204,12 @@ msgstr ""
 "назначать три разных стиля записи имён пользователей:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3599 sssd.conf.5.xml:3591
 msgid "domain\\username"
 msgstr "domain\\username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3602 sssd.conf.5.xml:3594
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -5171,7 +5218,7 @@ msgstr ""
 "обеспечения простой интеграции пользователей из доменов Windows."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3607 sssd.conf.5.xml:3599
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -5187,17 +5234,17 @@ msgstr ""
 "создать собственное re_expression."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3659 sssd.conf.5.xml:3651
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "По умолчанию: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3665 sssd.conf.5.xml:3657
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3668 sssd.conf.5.xml:3660
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -5206,46 +5253,46 @@ msgstr ""
 "следует использовать при выполнении запросов DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3672 sssd.conf.5.xml:3664
 msgid "Supported values:"
 msgstr "Поддерживаемые значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3675 sssd.conf.5.xml:3667
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: попытаться найти адрес IPv4, в случае неудачи попытаться найти "
 "адрес IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3670
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr "ipv4_only: пытаться разрешать имена узлов только в адреса IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3681 sssd.conf.5.xml:3673
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: попытаться найти адрес IPv6, в случае неудачи попытаться найти "
 "адрес IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3684 sssd.conf.5.xml:3676
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr "ipv6_only: пытаться разрешать имена узлов только в адреса IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3687 sssd.conf.5.xml:3679
 msgid "Default: ipv4_first"
 msgstr "По умолчанию: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3693 sssd.conf.5.xml:3685
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_server_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3696 sssd.conf.5.xml:3688
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
@@ -5255,7 +5302,7 @@ msgstr ""
 "следующему."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3701 sssd.conf.5.xml:3693
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
@@ -5264,6 +5311,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3697 sssd.conf.5.xml:3717 sssd.conf.5.xml:3738
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
@@ -5273,16 +5321,17 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3702
 msgid "Default: 1000"
 msgstr "По умолчанию: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3716 sssd.conf.5.xml:3708
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3719 sssd.conf.5.xml:3711
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
@@ -5294,12 +5343,12 @@ msgstr ""
 "следующего DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3736 sssd.conf.5.xml:3728
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3739 sssd.conf.5.xml:3731
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -5312,12 +5361,12 @@ msgstr ""
 "работу в автономном режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3757 sssd.conf.5.xml:3749
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_use_search_list (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3760 sssd.conf.5.xml:3752
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -5328,7 +5377,7 @@ msgstr ""
 "средах с неправильно настроенным DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3766 sssd.conf.5.xml:3758
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -5339,17 +5388,17 @@ msgstr ""
 "запросы DNS в таких средах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3772 sssd.conf.5.xml:3764
 msgid "Default: TRUE"
 msgstr "По умолчанию: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3778 sssd.conf.5.xml:3770
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3781 sssd.conf.5.xml:3773
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -5358,17 +5407,17 @@ msgstr ""
 "доменную часть запроса обнаружения служб DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3785 sssd.conf.5.xml:3777
 msgid "Default: Use the domain part of machine's hostname"
 msgstr "По умолчанию: использовать доменную часть имени узла компьютера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3791 sssd.conf.5.xml:3783
 msgid "failover_primary_timeout (integer)"
 msgstr "failover_primary_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3794 sssd.conf.5.xml:3786
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -5379,59 +5428,59 @@ msgstr ""
 "повторного подключения к основному серверу."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3801 sssd.conf.5.xml:3793
 msgid "Note: The minimum value is 31."
 msgstr "Примечание: минимальное значение — 31."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3804 sssd.conf.5.xml:3796
 msgid "Default: 31"
 msgstr "По умолчанию: 31"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3810 sssd.conf.5.xml:3802
 msgid "override_gid (integer)"
 msgstr "override_gid (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3813 sssd.conf.5.xml:3805
 msgid "Override the primary GID value with the one specified."
 msgstr "Переопределить значение основного GID указанным значением."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3819 sssd.conf.5.xml:3811
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3826 sssd.conf.5.xml:3818
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3829 sssd.conf.5.xml:3821
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 "С учётом регистра. Это значение не является корректным для поставщика данных "
 "AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3835 sssd.conf.5.xml:3827
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3837 sssd.conf.5.xml:3829
 msgid "Case insensitive."
 msgstr "Без учёта регистра."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3841 sssd.conf.5.xml:3833
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3844 sssd.conf.5.xml:3836
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -5443,7 +5492,7 @@ msgstr ""
 "регистр в выведенных данных."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3852 sssd.conf.5.xml:3844
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
@@ -5453,7 +5502,7 @@ msgstr ""
 "на сервере."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3822 sssd.conf.5.xml:3814
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -5462,17 +5511,17 @@ msgstr ""
 "значения: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3867 sssd.conf.5.xml:3859
 msgid "Default: True (False for AD provider)"
 msgstr "По умолчанию: True (False для поставщика данных AD)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3873 sssd.conf.5.xml:3865
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3876 sssd.conf.5.xml:3868
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -5484,47 +5533,47 @@ msgstr ""
 "параметров:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3882 sssd.conf.5.xml:3874
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3885 sssd.conf.5.xml:3877
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3888 sssd.conf.5.xml:3880
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3891 sssd.conf.5.xml:3883
 msgid "ldap_offline_timeout"
 msgstr "ldap_offline_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3894 sssd.conf.5.xml:3886
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3897 sssd.conf.5.xml:3889
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3900 sssd.conf.5.xml:3892
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3903 sssd.conf.5.xml:3895
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3906 sssd.conf.5.xml:3898
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
@@ -5533,57 +5582,57 @@ msgstr ""
 "ldap_krb5_keytab не задан явно)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3910 sssd.conf.5.xml:3902
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3913 sssd.conf.5.xml:3905
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3916 sssd.conf.5.xml:3908
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3919 sssd.conf.5.xml:3911
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3922 sssd.conf.5.xml:3914
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401 sssd.conf.5.xml:3917
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3928 sssd.conf.5.xml:3920
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3931 sssd.conf.5.xml:3923
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3934 sssd.conf.5.xml:3926
 msgid "auto_private_groups"
 msgstr "auto_private_groups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3937 sssd.conf.5.xml:3929
 msgid "case_sensitive"
 msgstr "case_sensitive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3942 sssd.conf.5.xml:3934
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5593,28 +5642,28 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3949 sssd.conf.5.xml:3941
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 "Примечание: этот параметр работает только для поставщиков данных IPA и AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3956 sssd.conf.5.xml:3948
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3967 sssd.conf.5.xml:3959
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3968 sssd.conf.5.xml:3960
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "плоское (NetBIOS) имя поддомена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3959 sssd.conf.5.xml:3951
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5630,7 +5679,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3973 sssd.conf.5.xml:3965
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5638,29 +5687,29 @@ msgstr ""
 "<emphasis>override_homedir</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3977 sssd.conf.5.xml:3969
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "По умолчанию: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3982 sssd.conf.5.xml:3974
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3985 sssd.conf.5.xml:3977
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Различные метки, сохранённые службой настройки realmd для этого домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3991 sssd.conf.5.xml:3983
 msgid "cached_auth_timeout (int)"
 msgstr "cached_auth_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3994 sssd.conf.5.xml:3986
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5674,7 +5723,7 @@ msgstr ""
 "сетевом режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:4002 sssd.conf.5.xml:3994
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
@@ -5684,12 +5733,12 @@ msgstr ""
 "значения."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:4007 sssd.conf.5.xml:3999
 msgid "Special value 0 implies that this feature is disabled."
 msgstr "Специальное значение «0» подразумевает, что эта возможность отключена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:4011 sssd.conf.5.xml:4003
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5700,12 +5749,12 @@ msgstr ""
 "обработки <quote>initgroups.</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:4022 sssd.conf.5.xml:4014
 msgid "local_auth_policy (string)"
 msgstr "local_auth_policy (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:4025 sssd.conf.5.xml:4017
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5725,7 +5774,7 @@ msgstr ""
 "и проверяются локально."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4037 sssd.conf.5.xml:4029
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5745,7 +5794,7 @@ msgstr ""
 "разделены запятыми, например, <quote>enable:passkey, enable:smartcard</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4050 sssd.conf.5.xml:4042
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5757,42 +5806,43 @@ msgstr ""
 "local_auth_policy: <quote>match</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4055
 msgid "local_auth_policy = match (default)"
 msgstr "local_auth_policy = match (по умолчанию)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4064 sssd.conf.5.xml:4056
 msgid "Passkey"
 msgstr "Ключ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4065 sssd.conf.5.xml:4057
 msgid "Smartcard"
 msgstr "Смарт-карта"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189 sssd.conf.5.xml:4060
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194 sssd.conf.5.xml:4063
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
 #: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4066 sssd.conf.5.xml:4067
 msgid "disabled"
 msgstr "выключено"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4074 sssd.conf.5.xml:4066
 msgid "LDAP"
 msgstr "LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4079 sssd.conf.5.xml:4071
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5805,7 +5855,7 @@ msgstr ""
 "е., например, вместо запроса пароля будет предложено ввести PIN-код."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4091 sssd.conf.5.xml:4083
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5821,7 +5871,7 @@ msgstr ""
 "local_auth_policy = only\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4087 sssd.conf.5.xml:4079
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5833,7 +5883,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4099 sssd.conf.5.xml:4091
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
@@ -5843,22 +5893,22 @@ msgstr ""
 "помощью смарт-карты."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4104 sssd.conf.5.xml:4096
 msgid "Default: match"
 msgstr "По умолчанию: match"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4109 sssd.conf.5.xml:4101
 msgid "auto_private_groups (string)"
 msgstr "auto_private_groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4115 sssd.conf.5.xml:4107
 msgid "true"
 msgstr "true"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4118 sssd.conf.5.xml:4110
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
@@ -5867,7 +5917,7 @@ msgstr ""
 "UID пользователя. Номер GID в этом случае игнорируется."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4122 sssd.conf.5.xml:4114
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5881,12 +5931,12 @@ msgstr ""
 "пространстве идентификаторов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4131 sssd.conf.5.xml:4123
 msgid "false"
 msgstr "false"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4134 sssd.conf.5.xml:4126
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
@@ -5895,12 +5945,12 @@ msgstr ""
 "ссылаться на объект группы в базе данных LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4140 sssd.conf.5.xml:4132
 msgid "hybrid"
 msgstr "hybrid"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4143 sssd.conf.5.xml:4135
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5915,7 +5965,7 @@ msgstr ""
 "основной GID этого пользователя разрешается в этот объект группы."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4156 sssd.conf.5.xml:4148
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
@@ -5924,7 +5974,7 @@ msgstr ""
 "группы; в ином случае GID просто будет невозможно разрешить."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4163 sssd.conf.5.xml:4155
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5935,7 +5985,7 @@ msgstr ""
 "сохранить существующие закрытые группы пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4112 sssd.conf.5.xml:4104
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -5944,7 +5994,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4175 sssd.conf.5.xml:4167
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
@@ -5954,7 +6004,7 @@ msgstr ""
 "поддоменов, которые используют автоматическое сопоставление идентификаторов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4183 sssd.conf.5.xml:4175
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5964,7 +6014,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4189 sssd.conf.5.xml:4181
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5976,7 +6026,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4180 sssd.conf.5.xml:4172
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5990,7 +6040,7 @@ msgstr ""
 "type=\"programlisting\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2579 sssd.conf.5.xml:2577
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -6001,17 +6051,17 @@ msgstr ""
 "replaceable>]</quote> <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4204 sssd.conf.5.xml:4196
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4207 sssd.conf.5.xml:4199
 msgid "The proxy target PAM proxies to."
 msgstr "Цель, которой пересылает данные прокси PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4210 sssd.conf.5.xml:4202
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -6023,12 +6073,12 @@ msgstr ""
 "local_auth_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4220 sssd.conf.5.xml:4212
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4223 sssd.conf.5.xml:4215
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -6039,12 +6089,12 @@ msgstr ""
 "_nss_$(libName)_$(function), например: _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4233 sssd.conf.5.xml:4225
 msgid "proxy_resolver_lib_name (string)"
 msgstr "proxy_resolver_lib_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4236 sssd.conf.5.xml:4228
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -6055,12 +6105,12 @@ msgstr ""
 "вид _nss_$(libName)_$(function), например: _nss_dns_gethostbyname2_r."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4247 sssd.conf.5.xml:4239
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4250 sssd.conf.5.xml:4242
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -6074,12 +6124,12 @@ msgstr ""
 "идентификатора в кэше в целях ускорения предоставления результатов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4264 sssd.conf.5.xml:4256
 msgid "proxy_max_children (integer)"
 msgstr "proxy_max_children (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4267 sssd.conf.5.xml:4259
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -6091,7 +6141,7 @@ msgstr ""
 "постановки запросов в очередь."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4200 sssd.conf.5.xml:4192
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -6100,12 +6150,12 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4283 sssd.conf.5.xml:4275
 msgid "Application domains"
 msgstr "Домены приложений"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4285 sssd.conf.5.xml:4277
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -6134,7 +6184,7 @@ msgstr ""
 "традиционного домена SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4305 sssd.conf.5.xml:4297
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -6145,17 +6195,17 @@ msgstr ""
 "порядок поиска для домена приложений и его родственного домена POSIX."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4311 sssd.conf.5.xml:4303
 msgid "Application domain parameters"
 msgstr "Параметры доменов приложений"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4313 sssd.conf.5.xml:4305
 msgid "inherit_from (string)"
 msgstr "inherit_from (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4316 sssd.conf.5.xml:4308
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -6168,7 +6218,7 @@ msgstr ""
 "<quote>родственного</quote> домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4330 sssd.conf.5.xml:4322
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -6183,7 +6233,7 @@ msgstr ""
 "атрибут phone доступным через интерфейс D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4338 sssd.conf.5.xml:4330
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6217,12 +6267,12 @@ msgstr ""
 "ldap_user_extra_attrs = phone:telephoneNumber\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4358 sssd.conf.5.xml:4350
 msgid "TRUSTED DOMAIN SECTION"
 msgstr "РАЗДЕЛ ДОВЕРЕННЫХ ДОМЕНОВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4360 sssd.conf.5.xml:4352
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -6240,57 +6290,57 @@ msgstr ""
 "поддерживаются следующие параметры:"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4367 sssd.conf.5.xml:4359
 msgid "ldap_search_base,"
 msgstr "ldap_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4368 sssd.conf.5.xml:4360
 msgid "ldap_user_search_base,"
 msgstr "ldap_user_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4369 sssd.conf.5.xml:4361
 msgid "ldap_group_search_base,"
 msgstr "ldap_group_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4370 sssd.conf.5.xml:4362
 msgid "ldap_netgroup_search_base,"
 msgstr "ldap_netgroup_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4371 sssd.conf.5.xml:4363
 msgid "ldap_service_search_base,"
 msgstr "ldap_service_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4372 sssd.conf.5.xml:4364
 msgid "ldap_sasl_mech,"
 msgstr "ldap_sasl_mech,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4373 sssd.conf.5.xml:4365
 msgid "ad_server,"
 msgstr "ad_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4374 sssd.conf.5.xml:4366
 msgid "ad_backup_server,"
 msgstr "ad_backup_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4375 sssd.conf.5.xml:4367
 msgid "ad_site,"
 msgstr "ad_site,"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884 sssd.conf.5.xml:4368
 msgid "use_fully_qualified_names"
 msgstr "use_fully_qualified_names"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4380 sssd.conf.5.xml:4372
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
@@ -6299,12 +6349,12 @@ msgstr ""
 "справочной странице."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4386 sssd.conf.5.xml:4378
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr "РАЗДЕЛ СОПОСТАВЛЕНИЯ СЕРТИФИКАТОВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4388 sssd.conf.5.xml:4380
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -6327,7 +6377,7 @@ msgstr ""
 "проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4402 sssd.conf.5.xml:4394
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -6338,7 +6388,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4411 sssd.conf.5.xml:4403
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -6351,12 +6401,12 @@ msgstr ""
 "replaceable>]</quote>. В этом разделе допустимы следующие параметры:"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4418 sssd.conf.5.xml:4410
 msgid "matchrule (string)"
 msgstr "matchrule (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4421 sssd.conf.5.xml:4413
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
@@ -6365,7 +6415,7 @@ msgstr ""
 "соответствуют этому правилу. Все остальные будут игнорироваться."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4425 sssd.conf.5.xml:4417
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
@@ -6375,17 +6425,17 @@ msgstr ""
 "<quote>clientAuth</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4432 sssd.conf.5.xml:4424
 msgid "maprule (string)"
 msgstr "maprule (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4435 sssd.conf.5.xml:4427
 msgid "Defines how the user is found for a given certificate."
 msgstr "Определяет способ поиска пользователя для указанного сертификата."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4441 sssd.conf.5.xml:4433
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
@@ -6395,7 +6445,7 @@ msgstr ""
 "quote>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4447 sssd.conf.5.xml:4439
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
@@ -6404,12 +6454,12 @@ msgstr ""
 "пользователя с таким же именем."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4456 sssd.conf.5.xml:4448
 msgid "domains (string)"
 msgstr "domains (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4459 sssd.conf.5.xml:4451
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -6422,17 +6472,17 @@ msgstr ""
 "параметра можно добавить правило также и в поддомены."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4466 sssd.conf.5.xml:4458
 msgid "Default: the configured domain in sssd.conf"
 msgstr "По умолчанию: настроенный домен в sssd.conf"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4471 sssd.conf.5.xml:4463
 msgid "priority (integer)"
 msgstr "priority (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4474 sssd.conf.5.xml:4466
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -6443,12 +6493,12 @@ msgstr ""
 "приоритет, а <quote>4294967295</quote> — самый низкий."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4480 sssd.conf.5.xml:4472
 msgid "Default: the lowest priority"
 msgstr "По умолчанию: самый низкий приоритет"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4486 sssd.conf.5.xml:4478
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
@@ -6458,7 +6508,7 @@ msgstr ""
 "свойства:"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4492 sssd.conf.5.xml:4484
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
@@ -6467,7 +6517,7 @@ msgstr ""
 "RULE_NAME"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4498 sssd.conf.5.xml:4490
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -6480,17 +6530,17 @@ msgstr ""
 "<quote>({subject_rfc822_name.short_name})</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4507 sssd.conf.5.xml:4499
 msgid "the <quote>domains</quote> option is ignored"
 msgstr "параметр <quote>domains</quote> игнорируется"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4515 sssd.conf.5.xml:4507
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr "РАЗДЕЛ НАСТРОЙКИ ЗАПРОСОВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4517 sssd.conf.5.xml:4509
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -6505,7 +6555,7 @@ msgstr ""
 "запросит у пользователя соответствующие учётные данные."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4525 sssd.conf.5.xml:4517
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -6518,22 +6568,22 @@ msgstr ""
 "Следующие параметры обеспечивают более гибкую настройку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4537 sssd.conf.5.xml:4529
 msgid "[prompting/password]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4540 sssd.conf.5.xml:4532
 msgid "password_prompt"
 msgstr "password_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4541 sssd.conf.5.xml:4533
 msgid "to change the string of the password prompt"
 msgstr "изменить строку запроса пароля"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4539 sssd.conf.5.xml:4531
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6542,37 +6592,37 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4549 sssd.conf.5.xml:4541
 msgid "[prompting/2fa]"
 msgstr "[prompting/2fa]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4553 sssd.conf.5.xml:4545
 msgid "first_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4554 sssd.conf.5.xml:4546
 msgid "to change the string of the prompt for the first factor"
 msgstr "изменить строку запроса первого фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4557 sssd.conf.5.xml:4549
 msgid "second_prompt"
 msgstr "second_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4558 sssd.conf.5.xml:4550
 msgid "to change the string of the prompt for the second factor"
 msgstr "изменить строку запроса второго фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4561 sssd.conf.5.xml:4553
 msgid "single_prompt"
 msgstr "single_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4562 sssd.conf.5.xml:4554
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -6585,7 +6635,7 @@ msgstr ""
 "фактора, даже если второй фактор является необязательным."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4551 sssd.conf.5.xml:4543
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -6598,17 +6648,17 @@ msgstr ""
 "пароль, либо оба фактора, следует использовать двухэтапный запрос."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4579 sssd.conf.5.xml:4571
 msgid "[prompting/passkey]"
 msgstr "[prompting/passkey]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021 sssd.conf.5.xml:4577
 msgid "interactive"
 msgstr "interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4587 sssd.conf.5.xml:4579
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -6619,22 +6669,22 @@ msgstr ""
 "тактильного переключателя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4595 sssd.conf.5.xml:4587
 msgid "interactive_prompt"
 msgstr "interactive_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4597 sssd.conf.5.xml:4589
 msgid "to change the message of the interactive prompt."
 msgstr "изменить сообщение интерактивного запроса."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4602 sssd.conf.5.xml:4594
 msgid "touch"
 msgstr "touch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4604 sssd.conf.5.xml:4596
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
@@ -6643,17 +6693,17 @@ msgstr ""
 "пользователю о необходимости коснуться устройства."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4610 sssd.conf.5.xml:4602
 msgid "touch_prompt"
 msgstr "touch_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4612 sssd.conf.5.xml:4604
 msgid "to change the message of the touch prompt."
 msgstr "изменить сообщение запроса касания."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4581 sssd.conf.5.xml:4573
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -6662,7 +6712,7 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4532 sssd.conf.5.xml:4524
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -6676,7 +6726,7 @@ msgstr ""
 "type=\"variablelist\" id=\"2\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4623 sssd.conf.5.xml:4615
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -6688,11 +6738,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4622
 msgid "EXAMPLES"
 msgstr "ПРИМЕРЫ"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4636 sssd.conf.5.xml:4628
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6744,7 +6795,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4632 sssd.conf.5.xml:4624
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6756,7 +6807,7 @@ msgstr ""
 "документации. <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4668 sssd.conf.5.xml:4660
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6766,7 +6817,7 @@ msgstr ""
 "use_fully_qualified_names = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4662 sssd.conf.5.xml:4654
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6783,7 +6834,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4679 sssd.conf.5.xml:4671
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6799,7 +6850,7 @@ msgstr ""
 "priority = 10\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4673 sssd.conf.5.xml:4665
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -18062,10 +18113,10 @@ msgstr ""
 "<citerefentry><refentrytitle>ssh</refentrytitle> <manvolnum>1</manvolnum></"
 "citerefentry> можно настроить на использование <command>sss_ssh_knownhosts</"
 "command> для проверки подлинности узла по открытым ключам с использованием "
-"параметра <quote>KnownHostsCommand</quote>. Дополнительные сведения об этом "
-"параметре доступны на справочной странице <citerefentry> "
-"<refentrytitle>ssh_config</refentrytitle> <manvolnum>5</manvolnum></"
-"citerefentry>."
+"параметра <quote>KnownHostsCommand</quote>: <placeholder type="
+"\"programlisting\" id=\"0\"/> Дополнительные сведения об этом параметре "
+"доступны на справочной странице <citerefentry> <refentrytitle>ssh_config</"
+"refentrytitle> <manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sss_ssh_knownhosts.1.xml:65 sss_ssh_knownhostsproxy.1.xml:93
@@ -23259,6 +23310,23 @@ msgstr ""
 "узла и участника-пользователя. Эта возможность доступна в MIT Kerberos 1.7 и "
 "выше."
 
+#. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:601
+msgid ""
+"If a Certificate Revocation List (CRL)  is expired ignore the CRL checks for "
+"the related certificates. This option should be used to allow authentication "
+"when the system is offline and the CRL cannot be renewed."
+msgstr ""
+"Если срок действия списка отзыва сертификатов (CRL) истёк, игнорировать "
+"проверки CRL для соответствующих сертификатов. Этот параметр следует "
+"использовать, чтобы разрешить проверку подлинности, когда система находится "
+"в автономном режиме и нельзя обновить CRL."
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:2684
+msgid "Feature is only supported for domains with id_provider = ldap."
+msgstr "Функция поддерживается только для доменов с id_provider = ldap."
+
 #~ msgid ""
 #~ "<filename>sssd.conf</filename> must be a regular file that is owned, "
 #~ "readable, and writeable by '&sssd_user_name;' user (if SSSD is configured "
diff --git a/src/man/po/sv.po b/src/man/po/sv.po
index 9e1c8135825..6bc9e1c1a45 100644
--- a/src/man/po/sv.po
+++ b/src/man/po/sv.po
@@ -7,7 +7,7 @@ msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
 "POT-Creation-Date: 2024-06-25 13:25+0200\n"
-"PO-Revision-Date: 2024-03-05 18:36+0000\n"
+"PO-Revision-Date: 2024-09-02 11:38+0000\n"
 "Last-Translator: Göran Uddeborg <goeran@uddeborg.se>\n"
 "Language-Team: Swedish <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-manpage-master/sv/>\n"
@@ -16,7 +16,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.4\n"
+"X-Generator: Weblate 5.7.1\n"
 
 #. type: Content of: <reference><title>
 #: sssd.conf.5.xml:8 sssd-ldap.5.xml:5 pam_sss.8.xml:5 pam_sss_gss.8.xml:5
@@ -130,16 +130,13 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd.conf.5.xml:60
-#, fuzzy
-#| msgid ""
-#| "<filename>sssd.conf</filename> must be a regular file that is owned, "
-#| "readable, and writeable only by 'root'."
 msgid ""
 "<filename>sssd.conf</filename> must be a regular file that is owned, "
 "readable, and writeable by the same user as configured to run SSSD service."
 msgstr ""
 "<filename>sssd.conf</filename> måste vara en normal fil, som ägs av, är "
-"läsbar och skrivbar endast av ”root”."
+"läsbar och skrivbar av samma användare som är konfigurerad att köra tjänsten "
+"SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:67
@@ -651,18 +648,14 @@ msgstr "user (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:406
-#, fuzzy
-#| msgid ""
-#| "The user to drop the privileges to where appropriate to avoid running as "
-#| "the root user.  Currently the only supported value is '&sssd_user_name;'."
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
 "value is '&sssd_user_name;'."
 msgstr ""
-"Användaren att släppa privilegier till där det är tillämpligt för att "
-"undvika att köra som root-användaren. För närvarande är det enda värdet som "
-"stödjs ”&sssd_user_name;”."
+"En äldre (under utfasning) metod att konfigurera användaren att släppa "
+"privilegier till där det är tillämpligt för att undvika att köra som root-"
+"användaren. Det enda värdet som stödjs ”&sssd_user_name;”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:413
@@ -670,6 +663,8 @@ msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
+"Detta alternativ ignoreras om huvud-SSSD-processen startas under en annan "
+"användare en root initialt (den rekommenderade metoden)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:418
@@ -680,6 +675,11 @@ msgid ""
 "general isn't supported: everything should be configured to run either under "
 "'&sssd_user_name;' or 'root'."
 msgstr ""
+"Detta alternativ är inte tillämpligt på uttagsaktiverade tjänster, eftersom "
+"i det fallet är användaren som skall köra processerna konfigurerad i systemd-"
+"tjänstefiler. Tänk på det att användning av olika tjänsteanvändare för olika "
+"SSSD-komponenter inte stödjs i allmänhet: allting skall konfigureras att "
+"köra antingen som ”&sssd_user_name;” eller ”root”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:429
@@ -939,20 +939,16 @@ msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:601
-#, fuzzy
-#| msgid ""
-#| "If a Certificate Revocation List (CRL)  is expired ignore the CRL checks "
-#| "for the related certificates. This option should be used to allow "
-#| "authentication when the system is offline and the CRL cannot be renewed."
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
 "This option should be used to allow authentication when the system is "
 "offline and the CRL cannot be renewed."
 msgstr ""
-"Om en certifikatåterkalleleselista (CRL) gått ut, ignorera CRL-kontroller "
-"för de relaterade certifikaten. Denna flagga skall användas för att tillåta "
-"autentisering när systemet är frånkopplat och CRL:en inte kan förnyas."
+"Om en certifikatåterkalleleselista (CRL) gått ut, ignorera utgångsdatum för "
+"CRL:en och kontrollera de relaterade certifikaten med den utgångna CRL:en. "
+"Denna flagga skall användas för att tillåta autentisering när systemet är "
+"frånkopplat och CRL:en inte kan förnyas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:497
@@ -2590,10 +2586,8 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:1794
-#, fuzzy
-#| msgid "pam_p11_allowed_services (integer)"
 msgid "pam_p11_allowed_services (string)"
-msgstr "pam_p11_allowed_services (heltal)"
+msgstr "pam_p11_allowed_services (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1797
@@ -3315,13 +3309,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2299
-#, fuzzy
-#| msgid ""
-#| "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
-msgstr "Standard: 0 (endast root-användaren tillåts komma åt PAC-respondenten)"
+msgstr ""
+"Standard: 0, &sssd_user_name; (endast root och SSSD:s tjänsteanvändaren "
+"tillåts komma åt PAC-respondenten)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2303
@@ -3330,22 +3323,17 @@ msgstr "Standard: 0 (endast root-användaren tillåts komma åt PAC-respondenten
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2307
-#, fuzzy
-#| msgid ""
-#| "Please note that although the UID 0 is used as the default it will be "
-#| "overwritten with this option. If you still want to allow the root user to "
-#| "access the PAC responder, which would be the typical case, you have to "
-#| "add 0 to the list of allowed UIDs as well."
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
 "responder, which would be the typical case, you have to add those to the "
 "list of allowed UIDs explicitly."
 msgstr ""
-"Observera att även om AID 0 används som standard kommer det att skrivas över "
-"av detta alternativ. Om du fortfarande vill tillåta root-användaren att "
-"komma åt PAC-respondenten, vilket man typiskt vill, måste du lägga till även "
-"0 i listan av tillåtna AID:er."
+"Observera att standardvärden kommer det att skrivas över av detta "
+"alternativ. Om du fortfarande vill tillåta root- och/eller "
+"”&sssd_user_name;”-användaren att komma åt PAC-respondenten, vilket är det "
+"typiska fallet, måste man uttryckligen lägga till dessa i listan av tillåtna "
+"AID:er."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2314
@@ -3884,12 +3872,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2686
-#, fuzzy
-#| msgid "Feature is only supported for domains with id_provider = ldap."
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
-msgstr "Funktionen stödjs bara för domäner med id_provider = ldap."
+msgstr ""
+"Funktionen stödjs bara för domäner med id_provider = ldap eller id_provider "
+"= proxy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2690
@@ -3952,6 +3940,10 @@ msgid ""
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
 "documented behavior of nss modules to be used in this configuration."
 msgstr ""
+"Observera: proxyleverantören testas med moduler i öppen källkod som "
+"”libnss_file” och ”libnss_ldap”. 3:e-partsmoduler måste följa det "
+"dokumenterade beteendet hos nss-moduler för att användas i denna "
+"konfiguration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:2732
@@ -4373,21 +4365,14 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
 #: sssd.conf.5.xml:3286
-#, fuzzy
-#| msgid ""
-#| "<quote>ipa</quote>: FreeIPA and Red Hat Enterprise Identity Management "
-#| "provider. See <citerefentry> <refentrytitle>sssd-ipa</refentrytitle> "
-#| "<manvolnum>5</manvolnum> </citerefentry> for more information on "
-#| "configuring FreeIPA."
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
 "manvolnum> </citerefentry> for more information on configuring FreeIPA."
 msgstr ""
-"<quote>ipa</quote>: Leverantören FreeIPA och Red Hat Enterprise Identity "
-"Management. Se <citerefentry> <refentrytitle>sssd-ipa</refentrytitle> "
-"<manvolnum>5</manvolnum> </citerefentry> för mer information om att "
-"konfigurera FreeIPA."
+"<quote>ipa</quote>: Leverantören FreeIPA och Red Hat Identity Management. Se "
+"<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> för mer information om att konfigurera FreeIPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
@@ -5277,10 +5262,8 @@ msgstr "Standard: använd domändelen av maskinens värdnamn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:3791
-#, fuzzy
-#| msgid "p11_wait_for_card_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
-msgstr "p11_wait_for_card_timeout (heltal)"
+msgstr "failover_primary_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3794
@@ -5289,18 +5272,19 @@ msgid ""
 "This option defines the number of seconds SSSD waits before attempting to "
 "reconnect to the primary server."
 msgstr ""
+"När ingen primärserver är tillgänglig faller SSSD tillbaka på en "
+"reservserver. Detta alternativ definierar antalet sekunder SSSD väntar före "
+"den försöker återansluta till primärservern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3801
 msgid "Note: The minimum value is 31."
-msgstr ""
+msgstr "Observera: minimivärdet är 31."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3804
-#, fuzzy
-#| msgid "Default: 3:1"
 msgid "Default: 31"
-msgstr "Standard: 3:1"
+msgstr "Standard: 31"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
 #: sssd.conf.5.xml:3810
@@ -5611,14 +5595,6 @@ msgstr "local_auth_policy (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:4025
-#, fuzzy
-#| msgid ""
-#| "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
-#| "provider) only support a password based authentication, while others can "
-#| "handle PKINIT based Smartcard authentication (AD, IPA), two-factor "
-#| "authentication (IPA), or other methods against a central instance. By "
-#| "default in such cases authentication is only performed with the methods "
-#| "supported by the backend."
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5633,7 +5609,8 @@ msgstr ""
 "kan hantera PKINIT-baserad smart-kort-autentisering (AD, IPA), "
 "tvåfaktorsautentisering (IPA) eller andra metoder mot en central instans. "
 "Som standard utförs i sådana fall autentiseringen endast med metoderna som "
-"stödjs av bakänden."
+"stödjs av bakänden. Med detta alternativ kan ytterligare metoder aktiveras "
+"vilka utvärderas och kontrolleras lokalt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:4037
@@ -5662,25 +5639,24 @@ msgid ""
 "properly, are currently enabled or disabled for each backend, with the "
 "default local_auth_policy: <quote>match</quote>"
 msgstr ""
+"Följande tabell visar vilka autentiseringsmetoder, om rätt konfigurerade, "
+"som för närvarande är tillgängliga eller otillgängliga för varje bakände, "
+"med standard local_auth_policy: <quote>match</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
 #: sssd.conf.5.xml:4063
-#, fuzzy
-#| msgid "local_auth_policy (string)"
 msgid "local_auth_policy = match (default)"
-msgstr "local_auth_policy (sträng)"
+msgstr "local_auth_policy = match (standard)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
 #: sssd.conf.5.xml:4064
 msgid "Passkey"
-msgstr ""
+msgstr "Lösennyckel"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
 #: sssd.conf.5.xml:4065
-#, fuzzy
-#| msgid "gdm-smartcard"
 msgid "Smartcard"
-msgstr "gdm-smartcard"
+msgstr "Smartkort"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
 #: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
@@ -5694,15 +5670,13 @@ msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
 #: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
-#, fuzzy
-#| msgid "enabled"
 msgid "disabled"
-msgstr "aktiverat"
+msgstr "avaktiverad"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
 #: sssd.conf.5.xml:4074
 msgid "LDAP"
-msgstr ""
+msgstr "LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:4079
@@ -5750,6 +5724,9 @@ msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
+"Det är förväntat att leverantören <quote>files</quote> ignorerar "
+"alternativet local_auth_policy och stödjer smartkortsautentisering som "
+"standard."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:4104
@@ -6711,8 +6688,8 @@ msgstr ""
 "3. Följande exempel visar konfigurationen för en certifikatavbildningsregel. "
 "Den är giltig för den konfigurerade domänen <quote>min.domän</quote> och "
 "dessutom för underdomänerna <quote>din.domän</quote> och använder det "
-"fullständiga certifikatet i sökfiltret.\n"
-"<placeholder type=\"programlisting\" id=\"0\"/>"
+"fullständiga certifikatet i sökfiltret. <placeholder type=\"programlisting\" "
+"id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refnamediv><refname>
 #: sssd-ldap.5.xml:10 sssd-ldap.5.xml:16
@@ -8792,10 +8769,8 @@ msgstr "Standard: 0 (libldap-felsökning avaktiverat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
 #: sssd-ldap.5.xml:1643
-#, fuzzy
-#| msgid "ldap_id_mapping (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
-msgstr "ldap_id_mapping (boolean)"
+msgstr "ldap_use_ppolicy (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:1646
@@ -8804,6 +8779,9 @@ msgid ""
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
+"Slår på begäran av och förlitan på serversidans kontroller av "
+"lösenordspolicy. Avaktivering av detta möjliggör interaktion med tjänster "
+"vilka skickar tillbaka felaktiga ppolicy-utökningar."
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
@@ -15393,12 +15371,12 @@ msgstr "SLUTSTATUS"
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
 #: sssd.8.xml:214
 msgid "0"
-msgstr ""
+msgstr "0"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.8.xml:217
 msgid "SSSD was shutdown gracefully."
-msgstr ""
+msgstr "SSSD stängdes av snyggt."
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
 #: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
@@ -15408,35 +15386,33 @@ msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.8.xml:225
-#, fuzzy
-#| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
-msgstr "NSS-konfigurationsalternativ"
+msgstr "Felaktig konfiguration eller kommandoradsflagga."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
 #: sssd.8.xml:230
 msgid "2"
-msgstr ""
+msgstr "2"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.8.xml:233
 msgid "Memory allocation error."
-msgstr ""
+msgstr "Minnesallokeringsfel."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
 #: sssd.8.xml:238
 msgid "6"
-msgstr ""
+msgstr "6"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.8.xml:241
 msgid "SSSD is already running."
-msgstr ""
+msgstr "SSSD kör redan."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
 #: sssd.8.xml:246
 msgid "Other codes"
-msgstr ""
+msgstr "Andra koder"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.8.xml:249
@@ -15444,6 +15420,8 @@ msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
+"Andra koder markerar andra olika fel, sannolikt om saknade nödvändiga "
+"åtkomsträttigheter. Se SSSD:s och systemets loggar för detaljer."
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd.8.xml:260
@@ -17674,43 +17652,26 @@ msgstr "Om det lyckas returneras 0 som slutstatus.  Annars returneras 1."
 
 #. type: Content of: <reference><refentry><refnamediv><refname>
 #: sss_ssh_knownhosts.1.xml:10 sss_ssh_knownhosts.1.xml:15
-#, fuzzy
-#| msgid "sss_ssh_knownhostsproxy"
 msgid "sss_ssh_knownhosts"
-msgstr "sss_ssh_knownhostsproxy"
+msgstr "sss_ssh_knownhosts"
 
 #. type: Content of: <reference><refentry><refnamediv><refpurpose>
 #: sss_ssh_knownhosts.1.xml:16
-#, fuzzy
-#| msgid "get OpenSSH host keys"
 msgid "get OpenSSH known hosts public keys"
-msgstr "hämta OpenSSH-värdnycklar"
+msgstr "hämta OpenSSH kända värdars publika nycklar"
 
 #. type: Content of: <reference><refentry><refsynopsisdiv><cmdsynopsis>
 #: sss_ssh_knownhosts.1.xml:21
-#, fuzzy
-#| msgid ""
-#| "<command>sss_groupshow</command> <arg choice='opt'> <replaceable>options</"
-#| "replaceable> </arg> <arg choice='plain'><replaceable>GROUP</replaceable></"
-#| "arg>"
 msgid ""
 "<command>sss_ssh_knownhosts</command> <arg choice='opt'> "
 "<replaceable>options</replaceable> </arg> <arg "
 "choice='plain'><replaceable>HOST</replaceable></arg>"
 msgstr ""
-"<command>sss_groupshow</command> <arg choice='opt'> <replaceable>flaggor</"
-"replaceable> </arg> <arg choice='plain'><replaceable>GRUPP</replaceable></"
-"arg>"
+"<command>sss_knownhosts</command> <arg choice='opt'> <replaceable>flaggor</"
+"replaceable> </arg> <arg choice='plain'><replaceable>VÄRD</replaceable></arg>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sss_ssh_knownhosts.1.xml:32
-#, fuzzy
-#| msgid ""
-#| "<command>sss_ssh_authorizedkeys</command> acquires SSH public keys for "
-#| "user <replaceable>USER</replaceable> and outputs them in OpenSSH "
-#| "authorized_keys format (see the <quote>AUTHORIZED_KEYS FILE FORMAT</"
-#| "quote> section of <citerefentry><refentrytitle>sshd</refentrytitle> "
-#| "<manvolnum>8</manvolnum></citerefentry> for more information)."
 msgid ""
 "<command>sss_ssh_knownhosts</command> acquires SSH public keys for host "
 "<replaceable>HOST</replaceable> and outputs them in OpenSSH known_hosts key "
@@ -17718,11 +17679,11 @@ msgid ""
 "<citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</manvolnum></"
 "citerefentry> for more information)."
 msgstr ""
-"<command>sss_ssh_authorizedkeys</command> hämtar publika SSH-nycklar för "
-"användaren <replaceable>ANVÄNDARE</replaceable> och skriver ut dem i "
-"formatet för OpenSSH authorized_keys (se avsnittet <quote>AUTHORIZED_KEYS-"
-"FILFORMAT</quote> i <citerefentry><refentrytitle>sshd</refentrytitle> "
-"<manvolnum>8</manvolnum></citerefentry> för mer information)."
+"<command>sss_ssh_knownhosts</command> hämtar publika SSH-nycklar för värden "
+"<replaceable>VÄRD</replaceable> och skriver ut dem i formatet för OpenSSH:s "
+"known_hosts-nycklar (se avsnittet <quote>SSH_KNOWN_HOSTS-FILFORMAT</quote> i "
+"<citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</manvolnum></"
+"citerefentry> för mer information)."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
 #: sss_ssh_knownhosts.1.xml:47
@@ -17731,18 +17692,11 @@ msgid ""
 "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
+"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"            "
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sss_ssh_knownhosts.1.xml:41
-#, fuzzy
-#| msgid ""
-#| "<citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
-#| "manvolnum></citerefentry> can be configured to use "
-#| "<command>sss_ssh_authorizedkeys</command> for public key user "
-#| "authentication if it is compiled with support for "
-#| "<quote>AuthorizedKeysCommand</quote> option. Please refer to the "
-#| "<citerefentry> <refentrytitle>sshd_config</refentrytitle> <manvolnum>5</"
-#| "manvolnum></citerefentry> man page for more details about this option."
 msgid ""
 "<citerefentry><refentrytitle>ssh</refentrytitle> <manvolnum>1</manvolnum></"
 "citerefentry> can be configured to use <command>sss_ssh_knownhosts</command> "
@@ -17751,13 +17705,13 @@ msgid ""
 "to the <citerefentry> <refentrytitle>ssh_config</refentrytitle><manvolnum>5</"
 "manvolnum> </citerefentry> man page for more details about this option."
 msgstr ""
-"<citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</manvolnum></"
-"citerefentry> kan konfigureras till att använda "
-"<command>sss_ssh_authorizedkeys</command> för autentisering med användares "
-"publika nyckel om den är kompilerad med stöd för alternativet "
-"<quote>AuthorizedKeysCommand</quote>.  Se manualsidan <citerefentry> "
-"<refentrytitle>sshd_config</refentrytitle> <manvolnum>5</manvolnum></"
-"citerefentry> för mer detaljer om detta alternativ."
+"<citerefentry><refentrytitle>ssh</refentrytitle> <manvolnum>1</manvolnum></"
+"citerefentry> kan konfigureras till att använda <command>sss_ssh_knownhosts</"
+"command> för autentisering med värdens publika nyckel med alternativet "
+"<quote>KnownHostsCommand</quote>: <placeholder type=\"programlisting\" id=\"0"
+"\"/> Se manualsidan <citerefentry> <refentrytitle>ssh_config</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> för mer detaljer om detta "
+"alternativ."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sss_ssh_knownhosts.1.xml:65 sss_ssh_knownhostsproxy.1.xml:93
@@ -17769,14 +17723,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sss_ssh_knownhosts.1.xml:77
-#, fuzzy
-#| msgid ""
-#| "In case of success, an exit value of 0 is returned. Otherwise, 1 is "
-#| "returned."
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
-msgstr "Om det lyckas returneras 0 som slutstatus.  Annars returneras 1."
+msgstr ""
+"Om det lyckas köra, även om inga nycklar hittades, returneras 0. 1 "
+"returneras om något går fel."
 
 #. type: Content of: <reference><refentry><refnamediv><refname>
 #: sss_ssh_knownhostsproxy.1.xml:10 sss_ssh_knownhostsproxy.1.xml:15
@@ -17804,7 +17756,7 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sss_ssh_knownhostsproxy.1.xml:31
 msgid "LIFE-CYCLE"
-msgstr ""
+msgstr "LIVSCYKEL"
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sss_ssh_knownhostsproxy.1.xml:33
@@ -17812,6 +17764,8 @@ msgid ""
 "This tool is deprecated and will be removed in the future.  Consider using "
 "the more reliable <command>sss_ssh_knownhosts</command> instead."
 msgstr ""
+"Detta verktyg är föråldrat och kommer tas bort i framtiden. Överväg att "
+"använda det mer pålitliga <command>sss_ssh_knownhosts</command> istället."
 
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sss_ssh_knownhostsproxy.1.xml:43
@@ -20212,13 +20166,6 @@ msgstr "Namnet på LDAP-attributet som innehåller användarens e-postadress."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap-attributes.5.xml:626
-#, fuzzy
-#| msgid ""
-#| "Note: If an email address of a user conflicts with an email address or "
-#| "fully qualified name of another user, then SSSD will not be able to serve "
-#| "those users properly. If for some reason several users need to share the "
-#| "same email address then set this option to a nonexistent attribute name "
-#| "in order to disable user lookup/login by email."
 msgid ""
 "Note: If an email address of a user conflicts with an email address or fully "
 "qualified name of another user, then SSSD will not be able to serve those "
@@ -20229,10 +20176,11 @@ msgid ""
 msgstr ""
 "Observera: om en e-postadress för användaren står i konflikt med en e-"
 "postadress eller fullt kvalificerat namn för en annan användare, då kommer "
-"SSSD inte kunna serva dessa användare ordentligt.  Om flera användare av "
-"något skäl behöver dela samma e-postadress, sätt då detta attributnamn till "
-"ett som inte finns för att avaktivera uppslagning/inloggning av användare "
-"via e-post."
+"SSSD inte kunna serva dessa användare ordentligt. Detta alternativ gör att "
+"användare kan logga in med (1) användarnamn och (2) e-postadress. Om flera "
+"användare av något skäl behöver dela samma e-postadress, sätt då detta "
+"attributnamn till ett som inte finns för att avaktivera uppslagning/"
+"inloggning av användare via e-post."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap-attributes.5.xml:637
@@ -22169,45 +22117,6 @@ msgstr ""
 
 #. type: Content of: <refsect1><para>
 #: include/seealso.xml:4
-#, fuzzy
-#| msgid ""
-#| "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</"
-#| "manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
-#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> </"
-#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-attributes</"
-#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</manvolnum> </"
-#| "citerefentry>, <citerefentry> <refentrytitle>sssd-simple</"
-#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</manvolnum> </"
-#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ad</"
-#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
-#| "condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-"
-#| "files</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> "
-#| "<phrase condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
-#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, </phrase> "
-#| "<citerefentry> <refentrytitle>sssd-session-recording</refentrytitle> "
-#| "<manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sss_cache</refentrytitle><manvolnum>8</manvolnum> </"
-#| "citerefentry>, <citerefentry> <refentrytitle>sss_debuglevel</"
-#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sss_obfuscate</refentrytitle><manvolnum>8</manvolnum> </"
-#| "citerefentry>, <citerefentry> <refentrytitle>sss_seed</"
-#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle><manvolnum>8</"
-#| "manvolnum> </citerefentry>, <phrase condition=\"with_ssh\"> "
-#| "<citerefentry> <refentrytitle>sss_ssh_authorizedkeys</refentrytitle> "
-#| "<manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
-#| "<refentrytitle>sss_ssh_knownhostsproxy</refentrytitle> <manvolnum>8</"
-#| "manvolnum> </citerefentry>, </phrase> <phrase condition=\"with_ifp\"> "
-#| "<citerefentry> <refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</"
-#| "manvolnum> </citerefentry>, </phrase> <citerefentry> "
-#| "<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
-#| "citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</"
-#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> <phrase "
-#| "condition=\"with_stap\"> <citerefentry> <refentrytitle>sssd-systemtap</"
-#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> </phrase>"
 msgid ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
 "citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
@@ -22248,42 +22157,44 @@ msgid ""
 "citerefentry> </phrase>"
 msgstr ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
-"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"citerefentry>, <citerefentry> <refentrytitle>sssd."
+"conf</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-attributes</"
-"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
-"<refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sssd-simple</"
-"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
-"<refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sssd-ad</"
-"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
-"condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-files</"
-"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> <phrase "
-"condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
+"citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-"
+"attributes</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, "
+"<citerefentry> <refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</"
+"manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd-"
+"simple</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, "
+"<citerefentry> <refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</"
+"manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd-"
+"ad</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
+"condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-"
+"files</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+"<phrase condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, </phrase> "
 "<citerefentry> <refentrytitle>sssd-session-recording</refentrytitle> "
 "<manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_cache</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sss_debuglevel</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+"citerefentry>, <citerefentry> "
+"<refentrytitle>sss_debuglevel</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>, <citerefentry> "
 "<refentrytitle>sss_obfuscate</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sss_seed</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+"citerefentry>, <citerefentry> "
+"<refentrytitle>sss_seed</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>, <citerefentry> "
 "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle><manvolnum>8</"
 "manvolnum> </citerefentry>, <phrase condition=\"with_ssh\"> <citerefentry> "
-"<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>8</"
+"<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
-"<refentrytitle>sss_ssh_knownhostsproxy</refentrytitle> <manvolnum>8</"
-"manvolnum> </citerefentry>, </phrase> <phrase condition=\"with_ifp\"> "
-"<citerefentry> <refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</"
-"manvolnum> </citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
+"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
+"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
+"citerefentry>, </phrase> <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 
 #. type: Content of: <listitem><para>
 #: include/ldap_search_bases.xml:3
diff --git a/src/man/po/uk.po b/src/man/po/uk.po
index 421ecec6721..32c30cd3618 100644
--- a/src/man/po/uk.po
+++ b/src/man/po/uk.po
@@ -16,7 +16,7 @@ msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
 "POT-Creation-Date: 2024-06-25 13:25+0200\n"
-"PO-Revision-Date: 2024-06-11 09:36+0000\n"
+"PO-Revision-Date: 2024-06-27 05:36+0000\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-manpage-master/uk/>\n"
@@ -270,7 +270,9 @@ msgstr ""
 #: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
 #: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
 #: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358 sssd.conf.5.xml:710
+#: sssd.conf.5.xml:725 sssd.conf.5.xml:948 sssd.conf.5.xml:1066
+#: sssd.conf.5.xml:2194
 msgid "Default: true"
 msgstr "Типове значення: true"
 
@@ -296,6 +298,8 @@ msgstr ""
 #: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
 #: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
+#: sssd.conf.5.xml:648 sssd.conf.5.xml:945 sssd.conf.5.xml:2097
+#: sssd.conf.5.xml:2164 sssd.conf.5.xml:4250
 msgid "Default: false"
 msgstr "Типове значення: false"
 
@@ -372,6 +376,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
 #: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:1286 sssd.conf.5.xml:1763 sssd.conf.5.xml:4266
 msgid "Default: 10"
 msgstr "Типове значення: 10"
 
@@ -435,12 +440,12 @@ msgstr ""
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
+#: sssd.conf.5.xml:252 sssd.conf.5.xml:782 sssd.conf.5.xml:780
 msgid "reconnection_retries (integer)"
 msgstr "reconnection_retries (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
+#: sssd.conf.5.xml:255 sssd.conf.5.xml:785 sssd.conf.5.xml:783
 msgid ""
 "Number of times services should attempt to reconnect in the event of a Data "
 "Provider crash or restart before they give up"
@@ -451,7 +456,7 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
+#: include/failover.xml:100 sssd.conf.5.xml:788 sssd.conf.5.xml:3722
 msgid "Default: 3"
 msgstr "Типове значення: 3"
 
@@ -479,7 +484,7 @@ msgstr ""
 "використовувати символ «/»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562 sssd.conf.5.xml:3554
 msgid "re_expression (string)"
 msgstr "re_expression (рядок)"
 
@@ -505,12 +510,12 @@ msgstr ""
 "ДОМЕНІВ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619 sssd.conf.5.xml:3611
 msgid "full_name_format (string)"
 msgstr "full_name_format (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622 sssd.conf.5.xml:3614
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -522,32 +527,32 @@ msgstr ""
 "домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633 sssd.conf.5.xml:3625
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634 sssd.conf.5.xml:3626
 msgid "user name"
 msgstr "ім’я користувача"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637 sssd.conf.5.xml:3629
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640 sssd.conf.5.xml:3632
 msgid "domain name as specified in the SSSD config file."
 msgstr "назва домену у форматі, вказаному у файлі налаштувань SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646 sssd.conf.5.xml:3638
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649 sssd.conf.5.xml:3641
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -556,7 +561,7 @@ msgstr ""
 "Directory, налаштованих та автоматично виявлених за зв’язками довіри IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630 sssd.conf.5.xml:3622
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -968,11 +973,6 @@ msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:601
-#, fuzzy
-#| msgid ""
-#| "If a Certificate Revocation List (CRL)  is expired ignore the CRL checks "
-#| "for the related certificates. This option should be used to allow "
-#| "authentication when the system is offline and the CRL cannot be renewed."
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -996,26 +996,26 @@ msgstr ""
 "параметри: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:614 sssd.conf.5.xml:612
 msgid "Unknown options are reported but ignored."
 msgstr ""
 "Обробник параметрів повідомлятиме про невідомі параметри і просто "
 "ігноруватиме їх."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:617 sssd.conf.5.xml:615
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 "Типове значення: не встановлено, тобто перевірка сертифікатів нічим не "
 "обмежуватиметься"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:623 sssd.conf.5.xml:621
 msgid "disable_netlink (boolean)"
 msgstr "disable_netlink (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:626 sssd.conf.5.xml:624
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
@@ -1024,7 +1024,7 @@ msgstr ""
 "адресах, посилання та виконання певних дій."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:631 sssd.conf.5.xml:629
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
@@ -1033,17 +1033,17 @@ msgstr ""
 "можна вимкнути встановленням для цього параметра значення «true»"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:636 sssd.conf.5.xml:634
 msgid "Default: false (netlink changes are detected)"
 msgstr "Типове значення: false (виявлення змін у netlink)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:641 sssd.conf.5.xml:639
 msgid "enable_files_domain (boolean)"
 msgstr "enable_files_domain (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:644 sssd.conf.5.xml:642
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
@@ -1052,12 +1052,12 @@ msgstr ""
 "<quote>id_provider=files</quote> до усіх явним чином налаштованих доменів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:655 sssd.conf.5.xml:653
 msgid "domain_resolution_order"
 msgstr "domain_resolution_order"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:658 sssd.conf.5.xml:656
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -1074,7 +1074,7 @@ msgstr ""
 "відбуватиметься у випадковому порядку для кожного батьківського домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:670 sssd.conf.5.xml:668
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -1108,17 +1108,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341 sssd.conf.5.xml:696
+#: sssd.conf.5.xml:1787 sssd.conf.5.xml:4316
 msgid "Default: Not set"
 msgstr "Типове значення: не встановлено"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:703 sssd.conf.5.xml:701
 msgid "implicit_pac_responder (boolean)"
 msgstr "implicit_pac_responder (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:706 sssd.conf.5.xml:704
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -1129,12 +1130,12 @@ msgstr ""
 "цього параметра значення «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:717 sssd.conf.5.xml:715
 msgid "core_dumpable (boolean)"
 msgstr "core_dumpable (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:720 sssd.conf.5.xml:718
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1147,17 +1148,17 @@ msgstr ""
 "більше."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:732 sssd.conf.5.xml:730
 msgid "passkey_verification (string)"
 msgstr "passkey_verification (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:740 sssd.conf.5.xml:738
 msgid "user_verification (boolean)"
 msgstr "user_verification (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:742 sssd.conf.5.xml:740
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
@@ -1166,7 +1167,7 @@ msgstr ""
 "розпізнавання. Якщо увімкнено, програма завжди надсилатиме запит щодо PIN."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:748 sssd.conf.5.xml:746
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1177,7 +1178,7 @@ msgstr ""
 "перезаписано сервером."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:735 sssd.conf.5.xml:733
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -1204,12 +1205,12 @@ msgstr ""
 "профілів.  <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:767 sssd.conf.5.xml:765
 msgid "SERVICES SECTIONS"
 msgstr "РОЗДІЛИ СЛУЖБ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:769 sssd.conf.5.xml:767
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1222,22 +1223,22 @@ msgstr ""
 "у розділі <quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:776 sssd.conf.5.xml:774
 msgid "General service configuration options"
 msgstr "Загальні параметри налаштування служб"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:778 sssd.conf.5.xml:776
 msgid "These options can be used to configure any service."
 msgstr "Цими параметрами можна скористатися для налаштування будь-яких служб."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:795 sssd.conf.5.xml:793
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:798 sssd.conf.5.xml:796
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1253,17 +1254,17 @@ msgstr ""
 "цього параметра і обмеженням \"hard\" у limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:807 sssd.conf.5.xml:805
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "Типове значення: 8192 (або обмеження у limits.conf \"hard\")"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:812 sssd.conf.5.xml:810
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:815 sssd.conf.5.xml:813
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1279,17 +1280,17 @@ msgstr ""
 "до 10 секунд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:824 sssd.conf.5.xml:822
 msgid "Default: 60, KCM: 300"
 msgstr "Типове значення: 60, KCM: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:827
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:832 sssd.conf.5.xml:830
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1307,7 +1308,8 @@ msgstr ""
 "із мережею нове значення обчислюється за такою формулою:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:843 sssd.conf.5.xml:899 sssd.conf.5.xml:841
+#: sssd.conf.5.xml:897
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
@@ -1316,7 +1318,7 @@ msgstr ""
 "offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:846 sssd.conf.5.xml:844
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1327,7 +1329,7 @@ msgstr ""
 "є 30. Кінцевий результат є кількістю секунд до наступної повторної спроби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:852 sssd.conf.5.xml:850
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
@@ -1337,17 +1339,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495 sssd.conf.5.xml:854
+#: sssd.conf.5.xml:1197 sssd.conf.5.xml:1580 sssd.conf.5.xml:1876
 msgid "Default: 60"
 msgstr "Типове значення: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:861 sssd.conf.5.xml:859
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout_max (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:864 sssd.conf.5.xml:862
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
@@ -1356,12 +1359,12 @@ msgstr ""
 "з'єднання із мережею після неуспішних спроби відновити з'єднання."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:869 sssd.conf.5.xml:867
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr "Значення 0 вимикає збільшення проміжку часу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:872 sssd.conf.5.xml:870
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
@@ -1370,7 +1373,7 @@ msgstr ""
 "параметра offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:876 sssd.conf.5.xml:874
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1384,7 +1387,7 @@ msgstr ""
 "offline_timeout_max, яке є принаймні учетверо більшим за offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:882 sssd.conf.5.xml:880
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
@@ -1393,17 +1396,17 @@ msgstr ""
 "стане перевизначення значення offline_timeout, тому не варто цього робити."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:887 sssd.conf.5.xml:885
 msgid "Default: 3600"
 msgstr "Типове значення: 3600"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:892 sssd.conf.5.xml:890
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout_random_offset (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:895 sssd.conf.5.xml:893
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
@@ -1412,7 +1415,7 @@ msgstr ""
 "обробників із вказаними інтервалами часу:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:902 sssd.conf.5.xml:900
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
@@ -1422,27 +1425,27 @@ msgstr ""
 "числом у такому діапазоні:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:907 sssd.conf.5.xml:905
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "[0 - offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:910 sssd.conf.5.xml:908
 msgid "A value of 0 disables the random offset addition."
 msgstr "Значення 0 призводить до вимикання додавання випадкового зсуву."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:913 sssd.conf.5.xml:911
 msgid "Default: 30"
 msgstr "Типове значення: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:918 sssd.conf.5.xml:916
 msgid "responder_idle_timeout"
 msgstr "responder_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:921 sssd.conf.5.xml:919
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1462,17 +1465,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
-#: sssd-ldap.5.xml:332
+#: sssd-ldap.5.xml:332 sssd.conf.5.xml:933 sssd.conf.5.xml:1210
+#: sssd.conf.5.xml:2329
 msgid "Default: 300"
 msgstr "Типове значення: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:940 sssd.conf.5.xml:938
 msgid "cache_first"
 msgstr "cache_first"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:943 sssd.conf.5.xml:941
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
@@ -1481,12 +1485,12 @@ msgstr ""
 "запису до модулів засобів надання даних."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:958 sssd.conf.5.xml:956
 msgid "NSS configuration options"
 msgstr "Параметри налаштування NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:960 sssd.conf.5.xml:958
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1494,12 +1498,12 @@ msgstr ""
 "Switch (NSS або перемикання служби визначення назв)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:965 sssd.conf.5.xml:963
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:968 sssd.conf.5.xml:966
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1508,17 +1512,17 @@ msgstr ""
 "кеші nss_sss у секундах"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:972 sssd.conf.5.xml:970
 msgid "Default: 120"
 msgstr "Типове значення: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:975
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:980 sssd.conf.5.xml:978
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1529,7 +1533,7 @@ msgstr ""
 "entry_cache_timeout для домену період часу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:986 sssd.conf.5.xml:984
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1544,7 +1548,7 @@ msgstr ""
 "розблокування після оновлення кешу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:996 sssd.conf.5.xml:994
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1558,17 +1562,18 @@ msgstr ""
 "можливість."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120 sssd.conf.5.xml:1002
+#: sssd.conf.5.xml:2118
 msgid "Default: 50"
 msgstr "Типове значення: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:1009 sssd.conf.5.xml:1007
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:1012 sssd.conf.5.xml:1010
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1580,16 +1585,17 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:1016 sssd.conf.5.xml:1775 sssd.conf.5.xml:2142
 msgid "Default: 15"
 msgstr "Типове значення: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:1023 sssd.conf.5.xml:1021
 msgid "local_negative_timeout (integer)"
 msgstr "local_negative_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:1026 sssd.conf.5.xml:1024
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1601,17 +1607,17 @@ msgstr ""
 "цю можливість."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1032 sssd.conf.5.xml:1030
 msgid "Default: 14400 (4 hours)"
 msgstr "Типове значення: 14400 (4 години)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1037 sssd.conf.5.xml:1035
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1040 sssd.conf.5.xml:1038
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1626,7 +1632,7 @@ msgstr ""
 "реєстраційного запису користувача (UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1048 sssd.conf.5.xml:1046
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1640,17 +1646,17 @@ msgstr ""
 "відфільтрованої групи."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1056 sssd.conf.5.xml:1054
 msgid "Default: root"
 msgstr "Типове значення: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1061 sssd.conf.5.xml:1059
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1064 sssd.conf.5.xml:1062
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1658,12 +1664,12 @@ msgstr ""
 "встановіть для цього параметра значення «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1075 sssd.conf.5.xml:1073
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1078 sssd.conf.5.xml:1076
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1672,7 +1678,7 @@ msgstr ""
 "каталог не вказано явним чином засобом надання даних домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1083 sssd.conf.5.xml:1081
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1680,7 +1686,7 @@ msgstr ""
 "для параметра override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1089 sssd.conf.5.xml:1087
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1692,23 +1698,25 @@ msgstr ""
 #. type: Content of: <varlistentry><listitem><para>
 #: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
 #: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1085 sssd.conf.5.xml:1647 sssd.conf.5.xml:1666
+#: sssd.conf.5.xml:1743
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "приклад: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1093 sssd.conf.5.xml:1091
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 "Типове значення: не встановлено (без замін для невстановлених домашніх "
 "каталогів)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1099 sssd.conf.5.xml:1097
 msgid "override_shell (string)"
 msgstr "override_shell (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1102 sssd.conf.5.xml:1100
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1720,19 +1728,19 @@ msgstr ""
 "або для кожного з доменів окремо."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1108 sssd.conf.5.xml:1106
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "Типове значення: не встановлено (SSSD використовуватиме значення, отримане "
 "від LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1114 sssd.conf.5.xml:1112
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1117 sssd.conf.5.xml:1115
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1740,13 +1748,13 @@ msgstr ""
 "визначення оболонки є таким:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1120 sssd.conf.5.xml:1118
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 "1. Якщо оболонку вказано у <quote>/etc/shells</quote>, її буде використано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1124 sssd.conf.5.xml:1122
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1756,7 +1764,7 @@ msgstr ""
 "shell_fallback."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1129 sssd.conf.5.xml:1127
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1765,14 +1773,14 @@ msgstr ""
 "<quote>/etc/shells</quote>, буде використано оболонку nologin."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1134 sssd.conf.5.xml:1132
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 "Для визначення будь-якої командної оболонки можна скористатися шаблоном "
 "заміни (*)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1137 sssd.conf.5.xml:1135
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1784,12 +1792,12 @@ msgstr ""
 "справою."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1144 sssd.conf.5.xml:1142
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "Порожній рядок оболонки буде передано без обробки до libc."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1147 sssd.conf.5.xml:1145
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1798,29 +1806,29 @@ msgstr ""
 "тобто у разі встановлення нової оболонки слід перезапустити SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1151 sssd.conf.5.xml:1149
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 "Типове значення: не встановлено. Автоматично використовується оболонка "
 "користувача."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1156 sssd.conf.5.xml:1154
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1159 sssd.conf.5.xml:1157
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "Замінити всі записи цих оболонок на shell_fallback"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1164 sssd.conf.5.xml:1162
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1167 sssd.conf.5.xml:1165
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1828,17 +1836,17 @@ msgstr ""
 "системі не встановлено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1171 sssd.conf.5.xml:1169
 msgid "Default: /bin/sh"
 msgstr "Типове значення: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1176 sssd.conf.5.xml:1174
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1179 sssd.conf.5.xml:1177
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1848,7 +1856,7 @@ msgstr ""
 "або на загальному рівні у розділі [nss], або окремо для кожного з доменів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1185 sssd.conf.5.xml:1183
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1858,12 +1866,14 @@ msgstr ""
 "зазвичай /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575 sssd.conf.5.xml:1190
+#: sssd.conf.5.xml:1573
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578 sssd.conf.5.xml:1193
+#: sssd.conf.5.xml:1576
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1872,12 +1882,12 @@ msgstr ""
 "чинним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1204 sssd.conf.5.xml:1202
 msgid "memcache_timeout (integer)"
 msgstr "memcache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1207 sssd.conf.5.xml:1205
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
@@ -1887,7 +1897,7 @@ msgstr ""
 "пам'яті."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1215 sssd.conf.5.xml:1213
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
@@ -1897,7 +1907,9 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323 sssd.conf.5.xml:1219
+#: sssd.conf.5.xml:1244 sssd.conf.5.xml:1269 sssd.conf.5.xml:1294
+#: sssd.conf.5.xml:1321
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
@@ -1907,12 +1919,12 @@ msgstr ""
 "пам’яті."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1229 sssd.conf.5.xml:1227
 msgid "memcache_size_passwd (integer)"
 msgstr "memcache_size_passwd (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1232 sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1923,12 +1935,14 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:2982
 msgid "Default: 8"
 msgstr "Типове значення: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1318 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1289 sssd.conf.5.xml:1316
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
@@ -1937,12 +1951,12 @@ msgstr ""
 "значно погіршити швидкодію SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1254 sssd.conf.5.xml:1252
 msgid "memcache_size_group (integer)"
 msgstr "memcache_size_group (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1257 sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1954,17 +1968,18 @@ msgstr ""
 #. type: Content of: <variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
-#: include/krb5_options.xml:11
+#: include/krb5_options.xml:11 sssd.conf.5.xml:1261 sssd.conf.5.xml:1313
+#: sssd.conf.5.xml:3743
 msgid "Default: 6"
 msgstr "Типове значення: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1279 sssd.conf.5.xml:1277
 msgid "memcache_size_initgroups (integer)"
 msgstr "memcache_size_initgroups (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1282 sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1975,12 +1990,12 @@ msgstr ""
 "initgroups."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1304 sssd.conf.5.xml:1302
 msgid "memcache_size_sid (integer)"
 msgstr "memcache_size_sid (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1307 sssd.conf.5.xml:1305
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1993,12 +2008,12 @@ msgstr ""
 "0 вимкне кеш у пам'яті для SID."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90 sssd.conf.5.xml:1329
 msgid "user_attributes (string)"
 msgstr "user_attributes (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1334 sssd.conf.5.xml:1332
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -2015,7 +2030,7 @@ msgstr ""
 "manvolnum> </citerefentry>, щоб дізнатися більше), але без типових значень."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1347 sssd.conf.5.xml:1345
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
@@ -2024,19 +2039,19 @@ msgstr ""
 "на те, чи не встановлено його для відповідача NSS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1352 sssd.conf.5.xml:1350
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 "Типове значення: не встановлено, резервне значення визначається за "
 "параметром InfoPipe"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1357 sssd.conf.5.xml:1355
 msgid "pwfield (string)"
 msgstr "pwfield (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1360 sssd.conf.5.xml:1358
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
@@ -2045,12 +2060,12 @@ msgstr ""
 "груп, для поля <quote>password</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1365 sssd.conf.5.xml:1363
 msgid "Default: <quote>*</quote>"
 msgstr "Типове значення: <quote>*</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1368 sssd.conf.5.xml:1366
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
@@ -2060,7 +2075,7 @@ msgstr ""
 "розділі [nss]."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1370
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -2073,12 +2088,12 @@ msgstr ""
 "shadowutils)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1384 sssd.conf.5.xml:1382
 msgid "PAM configuration options"
 msgstr "Параметри налаштування PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1386 sssd.conf.5.xml:1384
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -2087,12 +2102,12 @@ msgstr ""
 "Authentication Module (PAM або блокового модуля розпізнавання)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1391 sssd.conf.5.xml:1389
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1394 sssd.conf.5.xml:1392
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -2102,17 +2117,18 @@ msgstr ""
 "входу до системи)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412 sssd.conf.5.xml:1397
+#: sssd.conf.5.xml:1410
 msgid "Default: 0 (No limit)"
 msgstr "Типове значення: 0 (без обмежень)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1403
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1408 sssd.conf.5.xml:1406
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -2121,12 +2137,12 @@ msgstr ""
 "дозволену кількість спроб входу з визначенням помилкового пароля."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1418 sssd.conf.5.xml:1416
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1421 sssd.conf.5.xml:1419
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -2136,7 +2152,7 @@ msgstr ""
 "системи."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1426 sssd.conf.5.xml:1424
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -2148,17 +2164,18 @@ msgstr ""
 "увімкнути можливість автономного розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542 sssd.conf.5.xml:1430
+#: sssd.conf.5.xml:1540
 msgid "Default: 5"
 msgstr "Типове значення: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1438 sssd.conf.5.xml:1436
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1441 sssd.conf.5.xml:1439
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -2167,43 +2184,43 @@ msgstr ""
 "розпізнавання. Чим більшим є значення, тим більше повідомлень буде показано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1446 sssd.conf.5.xml:1444
 msgid "Currently sssd supports the following values:"
 msgstr "У поточній версії sssd передбачено підтримку таких значень:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1449 sssd.conf.5.xml:1447
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: не показувати жодних повідомлень"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1452 sssd.conf.5.xml:1450
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: показувати лише важливі повідомлення"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1456 sssd.conf.5.xml:1454
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: показувати всі інформаційні повідомлення"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1459 sssd.conf.5.xml:1457
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: показувати всі повідомлення та діагностичні дані"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1463 sssd.8.xml:63 sssd.conf.5.xml:1461
 msgid "Default: 1"
 msgstr "Типове значення: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1469 sssd.conf.5.xml:1467
 msgid "pam_response_filter (string)"
 msgstr "pam_response_filter (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1472 sssd.conf.5.xml:1470
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2217,7 +2234,7 @@ msgstr ""
 "встановлювати за допомогою pam_sss."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1480 sssd.conf.5.xml:1478
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
@@ -2227,37 +2244,37 @@ msgstr ""
 "повідомлень."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1487 sssd.conf.5.xml:1485
 msgid "ENV"
 msgstr "ENV"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1488 sssd.conf.5.xml:1486
 msgid "Do not send any environment variables to any service."
 msgstr "Не надсилати жодних змінних середовища до жодної служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1491 sssd.conf.5.xml:1489
 msgid "ENV:var_name"
 msgstr "ENV:назва_змінної"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1492 sssd.conf.5.xml:1490
 msgid "Do not send environment variable var_name to any service."
 msgstr "Не надсилати змінної середовища назва_змінної до жодної служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1496 sssd.conf.5.xml:1494
 msgid "ENV:var_name:service"
 msgstr "ENV:назва_змінної:служба"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1497 sssd.conf.5.xml:1495
 msgid "Do not send environment variable var_name to service."
 msgstr "Не надсилати змінної середовища назва_змінної до вказаної служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1485 sssd.conf.5.xml:1483
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -2266,7 +2283,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1504 sssd.conf.5.xml:1502
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2284,23 +2301,23 @@ msgstr ""
 "Змішування стилів вважається помилкою."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1515 sssd.conf.5.xml:1513
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr "Типове значення: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1518 sssd.conf.5.xml:1516
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr "Приклад: -ENV:KRB5CCNAME:sudo-i вилучає фільтр зі списку типових"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1525 sssd.conf.5.xml:1523
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1528 sssd.conf.5.xml:1526
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2311,7 +2328,7 @@ msgstr ""
 "що розпізнавання виконується на основі найсвіжіших даних."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1534 sssd.conf.5.xml:1532
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2325,18 +2342,19 @@ msgstr ""
 "надання даних профілів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1548 sssd.conf.5.xml:1546
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014 sssd.conf.5.xml:1549
+#: sssd.conf.5.xml:3006
 msgid "Display a warning N days before the password expires."
 msgstr ""
 "Показати попередження за вказану кількість днів перед завершенням дії пароля."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1554 sssd.conf.5.xml:1552
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2347,7 +2365,8 @@ msgstr ""
 "попередження."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017 sssd.conf.5.xml:1558
+#: sssd.conf.5.xml:3009
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2357,7 +2376,7 @@ msgstr ""
 "буде автоматично показано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1565 sssd.conf.5.xml:1563
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2367,16 +2386,17 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1568 sssd.conf.5.xml:4009
 msgid "Default: 0"
 msgstr "Типове значення: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1587 sssd.conf.5.xml:1585
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1590 sssd.conf.5.xml:1588
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2392,13 +2412,13 @@ msgstr ""
 "під час запуску системи."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1600 sssd.conf.5.xml:1598
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 "Типове значення: типово усі користувачі вважаються надійними (довіреними)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1604 sssd.conf.5.xml:1602
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
@@ -2407,12 +2427,12 @@ msgstr ""
 "відповідача PAM, навіть якщо користувача немає у списку pam_trusted_users."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1611 sssd.conf.5.xml:1609
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1614 sssd.conf.5.xml:1612
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
@@ -2421,12 +2441,12 @@ msgstr ""
 "отримувати навіть ненадійні користувачі."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1618 sssd.conf.5.xml:1616
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr "Визначено два спеціальних значення параметра pam_public_domains:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1622 sssd.conf.5.xml:1620
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
@@ -2434,7 +2454,7 @@ msgstr ""
 "PAM.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1626 sssd.conf.5.xml:1624
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2445,17 +2465,19 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
 #: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd-ldap.5.xml:1209 sssd.conf.5.xml:1628 sssd.conf.5.xml:1653
+#: sssd.conf.5.xml:1672 sssd.conf.5.xml:1909 sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:3938
 msgid "Default: none"
 msgstr "Типове значення: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1635 sssd.conf.5.xml:1633
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1638 sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
@@ -2464,7 +2486,7 @@ msgstr ""
 "замінити типове повідомлення «Доступ заборонено» («Permission denied»)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1643 sssd.conf.5.xml:1641
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
@@ -2474,7 +2496,7 @@ msgstr ""
 "(показувати усі повідомлення і діагностичні дані)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1651 sssd.conf.5.xml:1649
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2484,12 +2506,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1660 sssd.conf.5.xml:1658
 msgid "pam_account_locked_message (string)"
 msgstr "pam_account_locked_message (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1663 sssd.conf.5.xml:1661
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
@@ -2498,7 +2520,7 @@ msgstr ""
 "типове повідомлення «Доступ заборонено» («Permission denied»)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1670 sssd.conf.5.xml:1668
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2508,28 +2530,29 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1679 sssd.conf.5.xml:1677
 msgid "pam_passkey_auth (bool)"
 msgstr "pam_passkey_auth (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1682 sssd.conf.5.xml:1680
 msgid "Enable passkey device based authentication."
 msgstr "Увімкнути розпізнавання на основі пристрою ключа."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
-#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
+#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145 sssd.conf.5.xml:1683
+#: sssd.conf.5.xml:1995
 msgid "Default: True"
 msgstr "Типове значення: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1690 sssd.conf.5.xml:1688
 msgid "passkey_debug_libfido2 (bool)"
 msgstr "passkey_debug_libfido2 (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1693 sssd.conf.5.xml:1691
 msgid "Enable libfido2 library debug messages."
 msgstr "Увімкнути діагностичні повідомлення бібліотеки libfido2."
 
@@ -2537,17 +2560,17 @@ msgstr "Увімкнути діагностичні повідомлення б
 #: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
 #: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
 #: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
-#: include/ldap_id_mapping.xml:250
+#: include/ldap_id_mapping.xml:250 sssd.conf.5.xml:1694 sssd.conf.5.xml:1708
 msgid "Default: False"
 msgstr "Типове значення: False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1701 sssd.conf.5.xml:1699
 msgid "pam_cert_auth (bool)"
 msgstr "pam_cert_auth (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1704 sssd.conf.5.xml:1702
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2558,22 +2581,24 @@ msgstr ""
 "розпізнавання, типово таку сертифікацію вимкнено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1715 sssd.conf.5.xml:1713
 msgid "pam_cert_db_path (string)"
 msgstr "pam_cert_db_path (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1718 sssd.conf.5.xml:1716
 msgid "The path to the certificate database."
 msgstr "Шлях до бази даних сертифікатів."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1719 sssd.conf.5.xml:2244 sssd.conf.5.xml:4430
 msgid "Default:"
 msgstr "Типове значення:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248 sssd.conf.5.xml:1721
+#: sssd.conf.5.xml:2246
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
@@ -2582,12 +2607,12 @@ msgstr ""
 "служб сертифікації у форматі PEM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1733 sssd.conf.5.xml:1731
 msgid "pam_cert_verification (string)"
 msgstr "pam_cert_verification (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1736 sssd.conf.5.xml:1734
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2602,7 +2627,7 @@ msgstr ""
 "<quote>certificate_verification</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1747 sssd.conf.5.xml:1745
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2612,7 +2637,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1751 sssd.conf.5.xml:1749
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
@@ -2622,24 +2647,24 @@ msgstr ""
 "<quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1758 sssd.conf.5.xml:1756
 msgid "p11_child_timeout (integer)"
 msgstr "p11_child_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1761 sssd.conf.5.xml:1759
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 "Час у секундах, протягом якого pam_sss очікуватиме на завершення роботи "
 "p11_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1770 sssd.conf.5.xml:1768
 msgid "passkey_child_timeout (integer)"
 msgstr "passkey_child_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1773 sssd.conf.5.xml:1771
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
@@ -2647,12 +2672,12 @@ msgstr ""
 "роботи passkey_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1782 sssd.conf.5.xml:1780
 msgid "pam_app_services (string)"
 msgstr "pam_app_services (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1785 sssd.conf.5.xml:1783
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
@@ -2661,12 +2686,12 @@ msgstr ""
 "типу <quote>application</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1794 sssd.conf.5.xml:1792
 msgid "pam_p11_allowed_services (string)"
 msgstr "pam_p11_allowed_services (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1797 sssd.conf.5.xml:1795
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
@@ -2675,7 +2700,7 @@ msgstr ""
 "використання смарткарток."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1812 sssd.conf.5.xml:1810
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2685,7 +2710,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1801 sssd.conf.5.xml:1799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2705,63 +2730,63 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd-ad.5.xml:869 sssd-ad.5.xml:947 sssd.conf.5.xml:1814
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 "Типове значення: типовий набір назв служб PAM складається з таких значень:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648 sssd.conf.5.xml:1819
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653 sssd.conf.5.xml:1824
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658 sssd.conf.5.xml:1829
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673 sssd.conf.5.xml:1834
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668 sssd.conf.5.xml:1839
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678 sssd.conf.5.xml:1844
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956 sssd.conf.5.xml:1849
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961 sssd.conf.5.xml:1854
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1861 sssd.conf.5.xml:1859
 msgid "gnome-screensaver"
 msgstr "gnome-screensaver"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1869 sssd.conf.5.xml:1867
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1872 sssd.conf.5.xml:1870
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2772,12 +2797,12 @@ msgstr ""
 "має чекати на вставлення смарткартки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1883 sssd.conf.5.xml:1881
 msgid "p11_uri (string)"
 msgstr "p11_uri (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1886 sssd.conf.5.xml:1884
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2796,7 +2821,7 @@ msgstr ""
 "слід використовувати вказаний зчитувач."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1899 sssd.conf.5.xml:1897
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2806,7 +2831,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1903 sssd.conf.5.xml:1901
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2816,7 +2841,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1897 sssd.conf.5.xml:1895
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2830,17 +2855,17 @@ msgstr ""
 "який покаже і адреси PKCS#11."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1916 sssd.conf.5.xml:1914
 msgid "pam_initgroups_scheme"
 msgstr "pam_initgroups_scheme"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1924 sssd.conf.5.xml:1922
 msgid "always"
 msgstr "always"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1925 sssd.conf.5.xml:1923
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
@@ -2848,12 +2873,12 @@ msgstr ""
 "буде все одно застосовано"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1929 sssd.conf.5.xml:1927
 msgid "no_session"
 msgstr "no_session"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1930 sssd.conf.5.xml:1928
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
@@ -2862,12 +2887,12 @@ msgstr ""
 "тобто якщо користувач не працює у системі"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1935 sssd.conf.5.xml:1933
 msgid "never"
 msgstr "never"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1936 sssd.conf.5.xml:1934
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
@@ -2876,7 +2901,7 @@ msgstr ""
 "аж доки вони не застаріють"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1919 sssd.conf.5.xml:1917
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2889,17 +2914,18 @@ msgstr ""
 "таких значень: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1943 sssd.conf.5.xml:1941
 msgid "Default: no_session"
 msgstr "Типове значення: no_session"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377 sssd.conf.5.xml:1946
+#: sssd.conf.5.xml:4369
 msgid "pam_gssapi_services"
 msgstr "pam_gssapi_services"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1951 sssd.conf.5.xml:1949
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
@@ -2908,7 +2934,7 @@ msgstr ""
 "розпізнавання за GSSAPI за допомогою модуля pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1956 sssd.conf.5.xml:1954
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
@@ -2917,6 +2943,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1958 sssd.conf.5.xml:1989 sssd.conf.5.xml:2027
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2928,7 +2955,7 @@ msgstr ""
 "вищий пріоритет за значення у розділі домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1968 sssd.conf.5.xml:1966
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2938,22 +2965,24 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940 sssd.conf.5.xml:1964
+#: sssd.conf.5.xml:3932
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Приклад: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1972 sssd.conf.5.xml:1970
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr "Типове значення: - (розпізнавання за GSSAPI вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378 sssd.conf.5.xml:1975
+#: sssd.conf.5.xml:4370
 msgid "pam_gssapi_check_upn"
 msgstr "pam_gssapi_check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1980 sssd.conf.5.xml:1978
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2965,7 +2994,7 @@ msgstr ""
 "вважатиметься неуспішним, якщо перевірку не буде пройдено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1987 sssd.conf.5.xml:1985
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
@@ -2974,12 +3003,12 @@ msgstr ""
 "зможуть отримати бажаний квиток служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:2002 sssd.conf.5.xml:2000
 msgid "pam_gssapi_indicators_map"
 msgstr "pam_gssapi_indicators_map"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:2005 sssd.conf.5.xml:2003
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2990,7 +3019,7 @@ msgstr ""
 "відокремлених комами індикаторів розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:2011 sssd.conf.5.xml:2009
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -3015,7 +3044,7 @@ msgstr ""
 "служби PAM є порожнім, перевірка не закриватиме доступ для жодного запису."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:2024 sssd.conf.5.xml:2022
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -3026,7 +3055,7 @@ msgstr ""
 "вимкнути перевірку для певної служби PAM, додайте <quote>служба:-</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2035 sssd.conf.5.xml:2033
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
@@ -3035,7 +3064,7 @@ msgstr ""
 "індикаторів розпізнавання:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2038 sssd.conf.5.xml:2036
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
@@ -3044,7 +3073,7 @@ msgstr ""
 "зберігаються у файлах або на смарткартках."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2041 sssd.conf.5.xml:2039
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
@@ -3053,12 +3082,12 @@ msgstr ""
 "розпізнавання у обгортці каналу FAST."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2044 sssd.conf.5.xml:2042
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr "radius — попереднє розпізнавання за допомогою сервера RADIUS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2047 sssd.conf.5.xml:2045
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
@@ -3067,14 +3096,14 @@ msgstr ""
 "розпізнавання (2FA або одноразовий пароль, OTP) в IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2050 sssd.conf.5.xml:2048
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 "idp — попереднє розпізнавання за допомогою зовнішнього надавача даних "
 "профілів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2060 sssd.conf.5.xml:2058
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -3084,7 +3113,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2055 sssd.conf.5.xml:2053
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -3096,19 +3125,19 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2064 sssd.conf.5.xml:2062
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 "Типове значення: не встановлено (немає потреби у використанні індикаторів "
 "розпізнавання)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2070
 msgid "SUDO configuration options"
 msgstr "Параметри налаштування SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2074 sssd.conf.5.xml:2072
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -3126,12 +3155,12 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2091 sssd.conf.5.xml:2089
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2094 sssd.conf.5.xml:2092
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -3140,12 +3169,12 @@ msgstr ""
 "призначені для визначення часових обмежень для записів sudoers."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2106 sssd.conf.5.xml:2104
 msgid "sudo_threshold (integer)"
 msgstr "sudo_threshold (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2109 sssd.conf.5.xml:2107
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -3161,22 +3190,22 @@ msgstr ""
 "sudo IPA та групових пошуків команд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2128 sssd.conf.5.xml:2126
 msgid "AUTOFS configuration options"
 msgstr "Параметри налаштування AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2130 sssd.conf.5.xml:2128
 msgid "These options can be used to configure the autofs service."
 msgstr "Цими параметрами можна скористатися для налаштування служби autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2134 sssd.conf.5.xml:2132
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2137 sssd.conf.5.xml:2135
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -3187,22 +3216,22 @@ msgstr ""
 "базі даних, зокрема неіснуючих) перед повторним запитом до сервера обробки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2153 sssd.conf.5.xml:2151
 msgid "SSH configuration options"
 msgstr "Параметри налаштувань SSH"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2155 sssd.conf.5.xml:2153
 msgid "These options can be used to configure the SSH service."
 msgstr "Цими параметрами можна скористатися для налаштування служби SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2159 sssd.conf.5.xml:2157
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2162 sssd.conf.5.xml:2160
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -3210,12 +3239,12 @@ msgstr ""
 "Чи слід хешувати назви та адреси вузлів у керованому файлі known_hosts."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2171 sssd.conf.5.xml:2169
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2174 sssd.conf.5.xml:2172
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -3224,17 +3253,17 @@ msgstr ""
 "файлі known_hosts після надсилання запиту щодо ключів вузла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2178 sssd.conf.5.xml:2176
 msgid "Default: 180"
 msgstr "Типове значення: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2183 sssd.conf.5.xml:2181
 msgid "ssh_use_certificate_keys (bool)"
 msgstr "ssh_use_certificate_keys (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2186 sssd.conf.5.xml:2184
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -3248,12 +3277,12 @@ msgstr ""
 "refentrytitle> <manvolnum>1</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2201 sssd.conf.5.xml:2199
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr "ssh_use_certificate_matching_rules (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2204 sssd.conf.5.xml:2202
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -3269,7 +3298,7 @@ msgstr ""
 "відокремлених комами. Усі інші правила буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2213 sssd.conf.5.xml:2211
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -3281,7 +3310,7 @@ msgstr ""
 "сертифікатів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2220 sssd.conf.5.xml:2218
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -3294,7 +3323,7 @@ msgstr ""
 "розпізнавання за сертифікатом."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2227 sssd.conf.5.xml:2225
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
@@ -3304,7 +3333,7 @@ msgstr ""
 "проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2232 sssd.conf.5.xml:2230
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
@@ -3313,12 +3342,12 @@ msgstr ""
 "використано усі знайдені правила або типове правило"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2238 sssd.conf.5.xml:2236
 msgid "ca_db (string)"
 msgstr "ca_db (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2241 sssd.conf.5.xml:2239
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
@@ -3327,12 +3356,12 @@ msgstr ""
 "перевірки сертифікатів користувачів до отримання з них відкритих ключів ssh."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2261 sssd.conf.5.xml:2259
 msgid "PAC responder configuration options"
 msgstr "Параметри налаштування відповідача PAC"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2263 sssd.conf.5.xml:2261
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -3350,7 +3379,7 @@ msgstr ""
 "декодовано і визначено, виконуються деякі з таких дій:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2272 sssd.conf.5.xml:2270
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -3368,7 +3397,7 @@ msgstr ""
 "параметра default_shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2280 sssd.conf.5.xml:2278
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3377,18 +3406,18 @@ msgstr ""
 "додано до цих груп."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2286 sssd.conf.5.xml:2284
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 "Цими параметрами можна скористатися для налаштовування відповідача PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66 sssd.conf.5.xml:2288
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2293 sssd.conf.5.xml:2291
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3399,7 +3428,7 @@ msgstr ""
 "іменами користувачів визначатимуться під час запуску."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2299 sssd.conf.5.xml:2297
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
@@ -3408,14 +3437,14 @@ msgstr ""
 "root і користувачі служб SSSD)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2303 sssd.conf.5.xml:2301
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "Типове значення: 0 (доступ до відповідача PAC має лише адміністративний "
 "користувач (root))"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2307 sssd.conf.5.xml:2305
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -3429,7 +3458,7 @@ msgstr ""
 "відповідні записи явно."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2314 sssd.conf.5.xml:2312
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3443,12 +3472,12 @@ msgstr ""
 "запис 0."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2323 sssd.conf.5.xml:2321
 msgid "pac_lifetime (integer)"
 msgstr "pac_lifetime (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2326 sssd.conf.5.xml:2324
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
@@ -3457,12 +3486,12 @@ msgstr ""
 "використовувати для визначення членства користувача у групі."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2336 sssd.conf.5.xml:2334
 msgid "pac_check (string)"
 msgstr "pac_check (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2339 sssd.conf.5.xml:2337
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3479,12 +3508,12 @@ msgstr ""
 "krb5_validate встановлено значення «False», перевірки PAC буде пропущено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2353 sssd.conf.5.xml:2351
 msgid "no_check"
 msgstr "no_check"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2355 sssd.conf.5.xml:2353
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
@@ -3493,12 +3522,12 @@ msgstr ""
 "виконано не буде."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2361 sssd.conf.5.xml:2359
 msgid "pac_present"
 msgstr "pac_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2363 sssd.conf.5.xml:2361
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3509,12 +3538,12 @@ msgstr ""
 "зазнає невдачі."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2371 sssd.conf.5.xml:2369
 msgid "check_upn"
 msgstr "check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2373 sssd.conf.5.xml:2371
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
@@ -3523,12 +3552,12 @@ msgstr ""
 "користувача (UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2379 sssd.conf.5.xml:2377
 msgid "check_upn_allow_missing"
 msgstr "check_upn_allow_missing"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2381 sssd.conf.5.xml:2379
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3548,7 +3577,7 @@ msgstr ""
 "потреби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2393 sssd.conf.5.xml:2391
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3565,23 +3594,23 @@ msgstr ""
 "призведе до пропускання перевірки, і повідомлення зникне з журналу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2407 sssd.conf.5.xml:2405
 msgid "upn_dns_info_present"
 msgstr "upn_dns_info_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2409 sssd.conf.5.xml:2407
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 "PAC має містити буфер UPN-DNS-INFO; неявним чином встановлює «check_upn»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2414 sssd.conf.5.xml:2412
 msgid "check_upn_dns_info_ex"
 msgstr "check_upn_dns_info_ex"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2416 sssd.conf.5.xml:2414
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
@@ -3590,12 +3619,12 @@ msgstr ""
 "узгодженими дані у розширенні."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2423 sssd.conf.5.xml:2421
 msgid "upn_dns_info_ex_present"
 msgstr "upn_dns_info_ex_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2425 sssd.conf.5.xml:2423
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
@@ -3604,7 +3633,7 @@ msgstr ""
 "«check_upn_dns_info_ex», «upn_dns_info_present» і «check_upn»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2349 sssd.conf.5.xml:2347
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3613,7 +3642,7 @@ msgstr ""
 "відокремлених комами значень: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2435 sssd.conf.5.xml:2433
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
@@ -3622,12 +3651,12 @@ msgstr ""
 "check_upn_allow_missing, check_upn_dns_info_ex»)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2444 sssd.conf.5.xml:2442
 msgid "Session recording configuration options"
 msgstr "Параметри налаштовування запису сеансів"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2446 sssd.conf.5.xml:2444
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3642,32 +3671,32 @@ msgstr ""
 "session-recording</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2459 sssd.conf.5.xml:2457
 msgid "These options can be used to configure session recording."
 msgstr "Цими параметрами можна скористатися для налаштовування запису сеансів."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64 sssd.conf.5.xml:2461
 msgid "scope (string)"
 msgstr "scope (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71 sssd.conf.5.xml:2468
 msgid "\"none\""
 msgstr "\"none\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74 sssd.conf.5.xml:2471
 msgid "No users are recorded."
 msgstr "Користувачі не записуються."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79 sssd.conf.5.xml:2476
 msgid "\"some\""
 msgstr "\"some\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82 sssd.conf.5.xml:2479
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
@@ -3676,17 +3705,17 @@ msgstr ""
 "<replaceable>користувачі</replaceable> і <replaceable>групи</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91 sssd.conf.5.xml:2488
 msgid "\"all\""
 msgstr "\"all\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94 sssd.conf.5.xml:2491
 msgid "All users are recorded."
 msgstr "Усі користувачі записуються."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67 sssd.conf.5.xml:2464
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3695,17 +3724,17 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101 sssd.conf.5.xml:2498
 msgid "Default: \"none\""
 msgstr "Типове значення: none"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106 sssd.conf.5.xml:2503
 msgid "users (string)"
 msgstr "users (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109 sssd.conf.5.xml:2506
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3717,17 +3746,17 @@ msgstr ""
 "тощо."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115 sssd.conf.5.xml:2512
 msgid "Default: Empty. Matches no users."
 msgstr "Типове значення: порожнє. Не відповідає жодному користувачу."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120 sssd.conf.5.xml:2517
 msgid "groups (string)"
 msgstr "groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123 sssd.conf.5.xml:2520
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3740,7 +3769,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
-#: sssd-session-recording.5.xml:161
+#: sssd-session-recording.5.xml:161 sssd.conf.5.xml:2526 sssd.conf.5.xml:2558
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
 "performance cost, because each uncached request for a user requires "
@@ -3752,17 +3781,17 @@ msgstr ""
 "належить користувач."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136 sssd.conf.5.xml:2533
 msgid "Default: Empty. Matches no groups."
 msgstr "Типове значення: порожнє. Не відповідає жодній групі."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141 sssd.conf.5.xml:2538
 msgid "exclude_users (string)"
 msgstr "exclude_users (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144 sssd.conf.5.xml:2541
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
@@ -3771,17 +3800,17 @@ msgstr ""
 "записування. Може бути застосовано лише разом із «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148 sssd.conf.5.xml:2545
 msgid "Default: Empty. No users excluded."
 msgstr "Типове значення: порожнє. Не виключати жодного користувача."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153 sssd.conf.5.xml:2550
 msgid "exclude_groups (string)"
 msgstr "exclude_groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156 sssd.conf.5.xml:2553
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
@@ -3790,23 +3819,24 @@ msgstr ""
 "із записування. Може бути застосовано лише разом із «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168 sssd.conf.5.xml:2565
 msgid "Default: Empty. No groups excluded."
 msgstr "Типове значення: порожнє. Не виключати жодної групи."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2577 sssd.conf.5.xml:2575
 msgid "DOMAIN SECTIONS"
 msgstr "РОЗДІЛИ ДОМЕНІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
 #: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:4072 sssd.conf.5.xml:2582 sssd.conf.5.xml:4060
+#: sssd.conf.5.xml:4061 sssd.conf.5.xml:4064
 msgid "enabled"
 msgstr "enabled"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2587 sssd.conf.5.xml:2585
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3821,12 +3851,12 @@ msgstr ""
 "параметрі доменів у розділі <quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2599 sssd.conf.5.xml:2597
 msgid "domain_type (string)"
 msgstr "domain_type (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2602 sssd.conf.5.xml:2600
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3839,7 +3869,7 @@ msgstr ""
 "з доменів POSIX."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2610 sssd.conf.5.xml:2608
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
@@ -3848,7 +3878,7 @@ msgstr ""
 "<quote>application</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2614 sssd.conf.5.xml:2612
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3860,7 +3890,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) і відповідача PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2622 sssd.conf.5.xml:2620
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
@@ -3869,7 +3899,7 @@ msgstr ""
 "application з <quote>id_provider=ldap</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2626 sssd.conf.5.xml:2624
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
@@ -3878,17 +3908,17 @@ msgstr ""
 "ласка, ознайомтеся із розділом <quote>Домени програм</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2630 sssd.conf.5.xml:2628
 msgid "Default: posix"
 msgstr "Типове значення: posix"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2636 sssd.conf.5.xml:2634
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (ціле значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2639 sssd.conf.5.xml:2637
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3897,7 +3927,7 @@ msgstr ""
 "відповідає цим обмеженням, його буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2644 sssd.conf.5.xml:2642
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3910,7 +3940,7 @@ msgstr ""
 "основної групи і належать діапазону, буде виведено у звичайному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2649
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3919,17 +3949,17 @@ msgstr ""
 "лише повернення записів за назвою або ідентифікатором."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2655 sssd.conf.5.xml:2653
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Типові значення: 1 для min_id, 0 (без обмежень) для max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2661 sssd.conf.5.xml:2659
 msgid "enumerate (bool)"
 msgstr "enumerate (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2664 sssd.conf.5.xml:2662
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3942,22 +3972,23 @@ msgstr ""
 "мати такі значення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2672 sssd.conf.5.xml:2670
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = користувачі і групи нумеруються"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2675 sssd.conf.5.xml:2673
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = не використовувати нумерацію для цього домену"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2676 sssd.conf.5.xml:2961 sssd.conf.5.xml:3138
 msgid "Default: FALSE"
 msgstr "Типове значення: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2681 sssd.conf.5.xml:2679
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
@@ -3967,16 +3998,15 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2686
-#, fuzzy
-#| msgid "Feature is only supported for domains with id_provider = ldap."
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
-"Підтримку можливості передбачено лише для доменів з id_provider = ldap."
+"Підтримку можливості передбачено лише для доменів з id_provider = ldap або "
+"id_provider = proxy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2690 sssd.conf.5.xml:2688
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3999,7 +4029,7 @@ msgstr ""
 "<quote>sssd_be</quote> або навіть перезапуску усього засобу стеження."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2705 sssd.conf.5.xml:2703
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -4009,7 +4039,7 @@ msgstr ""
 "завершено."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2710 sssd.conf.5.xml:2708
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -4023,7 +4053,7 @@ msgstr ""
 "відповідного використаного засобу обробки ідентифікаторів (id_provider)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2718 sssd.conf.5.xml:2716
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -4038,34 +4068,38 @@ msgid ""
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
 "documented behavior of nss modules to be used in this configuration."
 msgstr ""
+"Зауваження: надавач даних проксі було перевірено з модулями із відкритим "
+"кодом, подібними до «libnss_files» і «libnss_ldap». Для сторонніх модулів "
+"мають виконуватися документовані вимоги до поведінки модулів nss, які буде "
+"використано у цій конфігурації."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2732 sssd.conf.5.xml:2724
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2739 sssd.conf.5.xml:2731
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2740 sssd.conf.5.xml:2732
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Усі виявлені надійні домени буде пронумеровано"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2743 sssd.conf.5.xml:2735
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2744 sssd.conf.5.xml:2736
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Нумерація виявлених надійних доменів не виконуватиметься"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2735 sssd.conf.5.xml:2727
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -4078,12 +4112,12 @@ msgstr ""
 "доменів, для яких буде увімкнено нумерацію."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2758 sssd.conf.5.xml:2750
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2761 sssd.conf.5.xml:2753
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -4092,7 +4126,7 @@ msgstr ""
 "надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2765 sssd.conf.5.xml:2757
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -4109,17 +4143,17 @@ msgstr ""
 "<manvolnum>8</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2778 sssd.conf.5.xml:2770
 msgid "Default: 5400"
 msgstr "Типове значення: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2784 sssd.conf.5.xml:2776
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2787 sssd.conf.5.xml:2779
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -4131,16 +4165,19 @@ msgstr ""
 #: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
 #: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
 #: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2783 sssd.conf.5.xml:2796 sssd.conf.5.xml:2809
+#: sssd.conf.5.xml:2822 sssd.conf.5.xml:2836 sssd.conf.5.xml:2849
+#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2877 sssd.conf.5.xml:2890
 msgid "Default: entry_cache_timeout"
 msgstr "Типове значення: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2797 sssd.conf.5.xml:2789
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2800 sssd.conf.5.xml:2792
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -4149,12 +4186,12 @@ msgstr ""
 "ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2810 sssd.conf.5.xml:2802
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2813 sssd.conf.5.xml:2805
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -4163,12 +4200,12 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2823 sssd.conf.5.xml:2815
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2826 sssd.conf.5.xml:2818
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -4177,12 +4214,12 @@ msgstr ""
 "ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2836 sssd.conf.5.xml:2828
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr "entry_cache_resolver_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2839 sssd.conf.5.xml:2831
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
@@ -4191,12 +4228,12 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2850 sssd.conf.5.xml:2842
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2853 sssd.conf.5.xml:2845
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -4205,12 +4242,12 @@ msgstr ""
 "надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2855
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2866 sssd.conf.5.xml:2858
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -4219,12 +4256,12 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2877 sssd.conf.5.xml:2869
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2880 sssd.conf.5.xml:2872
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -4234,12 +4271,12 @@ msgstr ""
 "вузла у кеші."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2891 sssd.conf.5.xml:2883
 msgid "entry_cache_computer_timeout (integer)"
 msgstr "entry_cache_computer_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2894 sssd.conf.5.xml:2886
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
@@ -4248,12 +4285,12 @@ msgstr ""
 "перш ніж надсилати запит до модуля обробки даних знову"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2904 sssd.conf.5.xml:2896
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2907 sssd.conf.5.xml:2899
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -4263,7 +4300,7 @@ msgstr ""
 "вичерпано або майже вичерпано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2912 sssd.conf.5.xml:2904
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -4277,18 +4314,18 @@ msgstr ""
 "запис користувача, і дані щодо участі у групах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2920 sssd.conf.5.xml:2912
 msgid "This option is automatically inherited for all trusted domains."
 msgstr "Цей параметр автоматично успадковується для усіх довірених доменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2924 sssd.conf.5.xml:2916
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 "Варто визначити для цього параметра значення 3/4 * entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2928 sssd.conf.5.xml:2920
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -4310,17 +4347,17 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
-#: sssd-ipa.5.xml:270
+#: sssd-ipa.5.xml:270 sssd.conf.5.xml:2933
 msgid "Default: 0 (disabled)"
 msgstr "Типове значення: 0 (вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2947 sssd.conf.5.xml:2939
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2950 sssd.conf.5.xml:2942
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -4337,7 +4374,7 @@ msgstr ""
 "мережеве розпізнавання було записано до кешу."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2961 sssd.conf.5.xml:2953
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -4350,12 +4387,12 @@ msgstr ""
 "додаткових прав доступу) і визначить пароль за допомогою простого перебору."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2975 sssd.conf.5.xml:2967
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr "cache_credentials_minimal_first_factor_length (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2978 sssd.conf.5.xml:2970
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -4367,7 +4404,7 @@ msgstr ""
 "контрольної суми SHA512 у кеші."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2985 sssd.conf.5.xml:2977
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
@@ -4377,12 +4414,12 @@ msgstr ""
 "мішенню атак із перебиранням паролів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2996 sssd.conf.5.xml:2988
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2999 sssd.conf.5.xml:2991
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -4395,17 +4432,17 @@ msgstr ""
 "offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:3006 sssd.conf.5.xml:2998
 msgid "Default: 0 (unlimited)"
 msgstr "Типове значення: 0 (без обмежень)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:3011 sssd.conf.5.xml:3003
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:3022 sssd.conf.5.xml:3014
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -4418,17 +4455,17 @@ msgstr ""
 "даних розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3029 sssd.conf.5.xml:3021
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Типове значення: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3035 sssd.conf.5.xml:3027
 msgid "id_provider (string)"
 msgstr "id_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3038 sssd.conf.5.xml:3030
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -4436,12 +4473,12 @@ msgstr ""
 "Серед підтримуваних засобів такі:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3042 sssd.conf.5.xml:3034
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr "«proxy»: підтримка застарілого модуля надання даних NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3045 sssd.conf.5.xml:3037
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4453,7 +4490,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3053 sssd.conf.5.xml:3045
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4465,7 +4502,8 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3286 sssd.conf.5.xml:3053 sssd.conf.5.xml:3164
+#: sssd.conf.5.xml:3215 sssd.conf.5.xml:3278
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4478,7 +4516,8 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3295 sssd.conf.5.xml:3062 sssd.conf.5.xml:3173
+#: sssd.conf.5.xml:3224 sssd.conf.5.xml:3287
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4490,12 +4529,12 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3081 sssd.conf.5.xml:3073
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3084 sssd.conf.5.xml:3076
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4505,7 +4544,7 @@ msgstr ""
 "NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3089 sssd.conf.5.xml:3081
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4518,7 +4557,7 @@ msgstr ""
 "не покаже користувача, а <command>getent passwd test@LOCAL</command> покаже."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3097 sssd.conf.5.xml:3089
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4529,7 +4568,7 @@ msgstr ""
 "груп, якщо задано неповну назву, буде виконано пошук у всіх доменах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3104 sssd.conf.5.xml:3096
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
@@ -4538,17 +4577,17 @@ msgstr ""
 "використано default_domain_suffix)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3111 sssd.conf.5.xml:3103
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3106
 msgid "Do not return group members for group lookups."
 msgstr "Не повертати записи учасників груп для пошуків груп."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3117 sssd.conf.5.xml:3109
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4567,7 +4606,7 @@ msgstr ""
 "$groupname</quote> поверне запитану групу так, наче вона була порожня."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3135 sssd.conf.5.xml:3127
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4582,7 +4621,8 @@ msgstr ""
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086 sssd.conf.5.xml:3133
+#: sssd.conf.5.xml:3854
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
@@ -4591,12 +4631,12 @@ msgstr ""
 "успадковано за допомогою <emphasis>subdomain_inherit</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3151 sssd.conf.5.xml:3143
 msgid "auth_provider (string)"
 msgstr "auth_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3154 sssd.conf.5.xml:3146
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4605,7 +4645,8 @@ msgstr ""
 "служб розпізнавання:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216 sssd.conf.5.xml:3150
+#: sssd.conf.5.xml:3208
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4617,7 +4658,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3165 sssd.conf.5.xml:3157
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4629,18 +4670,18 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3189 sssd.conf.5.xml:3181
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr "<quote>proxy</quote> — трансльоване розпізнавання у іншій системі PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3192 sssd.conf.5.xml:3184
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> — вимкнути розпізнавання повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3195 sssd.conf.5.xml:3187
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4649,12 +4690,12 @@ msgstr ""
 "спосіб встановлено і можлива обробка запитів щодо розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3201 sssd.conf.5.xml:3193
 msgid "access_provider (string)"
 msgstr "access_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3204 sssd.conf.5.xml:3196
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4665,7 +4706,7 @@ msgstr ""
 "Вбудованими програмами є:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3210 sssd.conf.5.xml:3202
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4674,12 +4715,12 @@ msgstr ""
 "доступу для локального домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3213 sssd.conf.5.xml:3205
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> — завжди забороняти доступ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3240 sssd.conf.5.xml:3232
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4692,7 +4733,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3247 sssd.conf.5.xml:3239
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4704,24 +4745,24 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3254 sssd.conf.5.xml:3246
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 "<quote>proxy</quote> — для трансляції керування доступом до іншого модуля "
 "PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3257 sssd.conf.5.xml:3249
 msgid "Default: <quote>permit</quote>"
 msgstr "Типове значення: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3262 sssd.conf.5.xml:3254
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3265 sssd.conf.5.xml:3257
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4730,7 +4771,7 @@ msgstr ""
 "підтримку таких систем зміни паролів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3270 sssd.conf.5.xml:3262
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4742,7 +4783,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3278 sssd.conf.5.xml:3270
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4754,18 +4795,18 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3303 sssd.conf.5.xml:3295
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr "<quote>proxy</quote> — трансльована зміна пароля у іншій системі PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3307 sssd.conf.5.xml:3299
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> — явно вимкнути можливість зміни пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3310 sssd.conf.5.xml:3302
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4774,19 +4815,19 @@ msgstr ""
 "цього параметра і якщо система здатна обробляти запити щодо паролів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3317 sssd.conf.5.xml:3309
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3320 sssd.conf.5.xml:3312
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "Служба SUDO, яку використано для цього домену. Серед підтримуваних служб "
 "SUDO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3324 sssd.conf.5.xml:3316
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4798,7 +4839,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3332 sssd.conf.5.xml:3324
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4807,7 +4848,7 @@ msgstr ""
 "параметрами IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3336 sssd.conf.5.xml:3328
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4816,20 +4857,22 @@ msgstr ""
 "параметрами AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3340 sssd.conf.5.xml:3332
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> явним чином вимикає SUDO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555 sssd.conf.5.xml:3335
+#: sssd.conf.5.xml:3421 sssd.conf.5.xml:3486 sssd.conf.5.xml:3511
+#: sssd.conf.5.xml:3547
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "Типове значення: використовується значення <quote>id_provider</quote>, якщо "
 "його встановлено."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3347 sssd.conf.5.xml:3339
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4848,7 +4891,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3362 sssd.conf.5.xml:3354
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4862,12 +4905,12 @@ msgstr ""
 "sudo у SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3372 sssd.conf.5.xml:3364
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3375 sssd.conf.5.xml:3367
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4878,7 +4921,7 @@ msgstr ""
 "доступу. Передбачено підтримку таких засобів надання даних SELinux:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3381 sssd.conf.5.xml:3373
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4890,14 +4933,14 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3389 sssd.conf.5.xml:3381
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 "<quote>none</quote> явним чином забороняє отримання даних щодо параметрів "
 "SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3392 sssd.conf.5.xml:3384
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4906,12 +4949,12 @@ msgstr ""
 "спосіб встановлено і можлива обробка запитів щодо завантаження SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3398 sssd.conf.5.xml:3390
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3401 sssd.conf.5.xml:3393
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4921,7 +4964,7 @@ msgstr ""
 "підтримку таких засобів надання даних піддоменів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3407 sssd.conf.5.xml:3399
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4933,7 +4976,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3416 sssd.conf.5.xml:3408
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4946,17 +4989,17 @@ msgstr ""
 "налаштовування засобу надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3425 sssd.conf.5.xml:3417
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "<quote>none</quote> забороняє ячним чином отримання даних піддоменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3435 sssd.conf.5.xml:3427
 msgid "session_provider (string)"
 msgstr "session_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3438 sssd.conf.5.xml:3430
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4968,14 +5011,14 @@ msgstr ""
 "постачальники даних сеансів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3445 sssd.conf.5.xml:3437
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 "<quote>ipa</quote>, щоб дозволити пов'язані із сеансами користувачів "
 "завдання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3449 sssd.conf.5.xml:3441
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
@@ -4983,7 +5026,7 @@ msgstr ""
 "користувачів завдань."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3453 sssd.conf.5.xml:3445
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
@@ -4992,12 +5035,12 @@ msgstr ""
 "його встановлено і дозволено виконувати пов'язані із сеансами завдання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3460 sssd.conf.5.xml:3452
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3463 sssd.conf.5.xml:3455
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -5005,7 +5048,7 @@ msgstr ""
 "autofs:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3467 sssd.conf.5.xml:3459
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5017,7 +5060,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3474 sssd.conf.5.xml:3466
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5029,7 +5072,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3482 sssd.conf.5.xml:3474
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5041,17 +5084,17 @@ msgstr ""
 "надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3491 sssd.conf.5.xml:3483
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> вимикає autofs повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3501 sssd.conf.5.xml:3493
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3504 sssd.conf.5.xml:3496
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -5060,7 +5103,7 @@ msgstr ""
 "вузла. Серед підтримуваних засобів надання hostid:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3508 sssd.conf.5.xml:3500
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -5072,17 +5115,17 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3516 sssd.conf.5.xml:3508
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> вимикає hostid повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3526 sssd.conf.5.xml:3518
 msgid "resolver_provider (string)"
 msgstr "resolver_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3529 sssd.conf.5.xml:3521
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
@@ -5091,7 +5134,7 @@ msgstr ""
 "підтримку таких надавачів даних для визначення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3533 sssd.conf.5.xml:3525
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
@@ -5100,7 +5143,7 @@ msgstr ""
 "Див. <quote>proxy_resolver_lib_name</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3537 sssd.conf.5.xml:3529
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -5112,7 +5155,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3544 sssd.conf.5.xml:3536
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -5125,13 +5168,13 @@ msgstr ""
 "налаштовування засобу надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3544
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 "<quote>none</quote> забороняє ячним чином отримання даних вузлів і мереж."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3565 sssd.conf.5.xml:3557
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -5145,7 +5188,7 @@ msgstr ""
 "IPA та доменів Active Directory, простій назві (NetBIOS) домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3574 sssd.conf.5.xml:3566
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
@@ -5154,17 +5197,19 @@ msgstr ""
 "name&gt;[^@]+))$</quote>, що дозволяє два різних стилі імен користувачів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593 sssd.conf.5.xml:3571
+#: sssd.conf.5.xml:3585
 msgid "username"
 msgstr "користувач"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596 sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3588
 msgid "username@domain.name"
 msgstr "користувач@назва.домену"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3587 sssd.conf.5.xml:3579
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -5177,12 +5222,12 @@ msgstr ""
 "стилі запису імен користувачів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3599 sssd.conf.5.xml:3591
 msgid "domain\\username"
 msgstr "домен\\користувач"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3602 sssd.conf.5.xml:3594
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -5191,7 +5236,7 @@ msgstr ""
 "того, щоб полегшити інтеграцію користувачів з доменів Windows."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3607 sssd.conf.5.xml:3599
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -5206,17 +5251,17 @@ msgstr ""
 "ім'я з <quote>@</quote>, йому слід скорити власний re_expression."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3659 sssd.conf.5.xml:3651
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Типове значення: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3665 sssd.conf.5.xml:3657
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3668 sssd.conf.5.xml:3660
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -5225,48 +5270,48 @@ msgstr ""
 "під час виконання пошуків у DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3672 sssd.conf.5.xml:3664
 msgid "Supported values:"
 msgstr "Передбачено підтримку таких значень:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3675 sssd.conf.5.xml:3667
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: спробувати визначити адресу у форматі IPv4, у разі невдачі "
 "спробувати формат IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3670
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 "ipv4_only: намагатися визначити назви вузлів лише у форматі адрес IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3681 sssd.conf.5.xml:3673
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: спробувати визначити адресу у форматі IPv6, у разі невдачі "
 "спробувати формат IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3684 sssd.conf.5.xml:3676
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 "ipv6_only: намагатися визначити назви вузлів лише у форматі адрес IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3687 sssd.conf.5.xml:3679
 msgid "Default: ipv4_first"
 msgstr "Типове значення: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3693 sssd.conf.5.xml:3685
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_server_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3696 sssd.conf.5.xml:3688
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
@@ -5275,7 +5320,7 @@ msgstr ""
 "обмінятися даними із сервером DNS, перш ніж пробувати наступний сервер DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3701 sssd.conf.5.xml:3693
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
@@ -5284,6 +5329,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3697 sssd.conf.5.xml:3717 sssd.conf.5.xml:3738
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
@@ -5293,16 +5339,17 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3702
 msgid "Default: 1000"
 msgstr "Типове значення: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3716 sssd.conf.5.xml:3708
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3719 sssd.conf.5.xml:3711
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
@@ -5314,12 +5361,12 @@ msgstr ""
 "наступного DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3736 sssd.conf.5.xml:3728
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3739 sssd.conf.5.xml:3731
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -5332,12 +5379,12 @@ msgstr ""
 "роботу у автономному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3757 sssd.conf.5.xml:3749
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_use_search_list (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3760 sssd.conf.5.xml:3752
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -5348,7 +5395,7 @@ msgstr ""
 "затримок у середовищах, де DNS не налаштовано належним чином."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3766 sssd.conf.5.xml:3758
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -5359,17 +5406,17 @@ msgstr ""
 "пошукам DNS у таких середовищах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3772 sssd.conf.5.xml:3764
 msgid "Default: TRUE"
 msgstr "Типове значення: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3778 sssd.conf.5.xml:3770
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3781 sssd.conf.5.xml:3773
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -5378,18 +5425,18 @@ msgstr ""
 "частину запиту визначення служб DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3785 sssd.conf.5.xml:3777
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 "Типова поведінка: використовувати назву домену з назви вузла комп’ютера."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3791 sssd.conf.5.xml:3783
 msgid "failover_primary_timeout (integer)"
 msgstr "failover_primary_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3794 sssd.conf.5.xml:3786
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -5400,58 +5447,58 @@ msgstr ""
 "встановити з'єднання із основним сервером."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3801 sssd.conf.5.xml:3793
 msgid "Note: The minimum value is 31."
 msgstr "Зауваження: мінімальним значенням є 31."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3804 sssd.conf.5.xml:3796
 msgid "Default: 31"
 msgstr "Типове значення: 31"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3810 sssd.conf.5.xml:3802
 msgid "override_gid (integer)"
 msgstr "override_gid (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3813 sssd.conf.5.xml:3805
 msgid "Override the primary GID value with the one specified."
 msgstr "Замірити значення основного GID на вказане."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3819 sssd.conf.5.xml:3811
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3826 sssd.conf.5.xml:3818
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3829 sssd.conf.5.xml:3821
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 "Враховується регістр. Це значення є некоректним для засобу надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3835 sssd.conf.5.xml:3827
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3837 sssd.conf.5.xml:3829
 msgid "Case insensitive."
 msgstr "Без врахування регістру."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3841 sssd.conf.5.xml:3833
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3844 sssd.conf.5.xml:3836
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -5463,7 +5510,7 @@ msgstr ""
 "буде переведено у нижній регістр."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3852 sssd.conf.5.xml:3844
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
@@ -5472,7 +5519,7 @@ msgstr ""
 "даних IPA, вам доведеться встановити його на боці клієнта і SSSD на сервері."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3822 sssd.conf.5.xml:3814
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -5481,17 +5528,17 @@ msgstr ""
 "значення: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3867 sssd.conf.5.xml:3859
 msgid "Default: True (False for AD provider)"
 msgstr "Типове значення: True (False для засобу надання даних AD)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3873 sssd.conf.5.xml:3865
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3876 sssd.conf.5.xml:3868
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -5503,47 +5550,47 @@ msgstr ""
 "параметрів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3882 sssd.conf.5.xml:3874
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3885 sssd.conf.5.xml:3877
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3888 sssd.conf.5.xml:3880
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3891 sssd.conf.5.xml:3883
 msgid "ldap_offline_timeout"
 msgstr "ldap_offline_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3894 sssd.conf.5.xml:3886
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3897 sssd.conf.5.xml:3889
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3900 sssd.conf.5.xml:3892
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3903 sssd.conf.5.xml:3895
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3906 sssd.conf.5.xml:3898
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
@@ -5552,57 +5599,57 @@ msgstr ""
 "ldap_krb5_keytab не встановлено явним чином)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3910 sssd.conf.5.xml:3902
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3913 sssd.conf.5.xml:3905
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3916 sssd.conf.5.xml:3908
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3919 sssd.conf.5.xml:3911
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3922 sssd.conf.5.xml:3914
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401 sssd.conf.5.xml:3917
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3928 sssd.conf.5.xml:3920
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3931 sssd.conf.5.xml:3923
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3934 sssd.conf.5.xml:3926
 msgid "auto_private_groups"
 msgstr "auto_private_groups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3937 sssd.conf.5.xml:3929
 msgid "case_sensitive"
 msgstr "case_sensitive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3942 sssd.conf.5.xml:3934
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5612,28 +5659,28 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3949 sssd.conf.5.xml:3941
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 "Зауваження: цей параметр працює лише для засобів надання даних IPA і AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3956 sssd.conf.5.xml:3948
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3967 sssd.conf.5.xml:3959
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3968 sssd.conf.5.xml:3960
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "спрощена (NetBIOS) назва піддомену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3959 sssd.conf.5.xml:3951
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5648,7 +5695,7 @@ msgstr ""
 "emphasis>.  <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3973 sssd.conf.5.xml:3965
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5656,17 +5703,17 @@ msgstr ""
 "emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3977 sssd.conf.5.xml:3969
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Типове значення: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3982 sssd.conf.5.xml:3974
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3985 sssd.conf.5.xml:3977
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
@@ -5674,12 +5721,12 @@ msgstr ""
 "домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3991 sssd.conf.5.xml:3983
 msgid "cached_auth_timeout (int)"
 msgstr "cached_auth_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3994 sssd.conf.5.xml:3986
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5693,7 +5740,7 @@ msgstr ""
 "розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:4002 sssd.conf.5.xml:3994
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
@@ -5703,12 +5750,12 @@ msgstr ""
 "значення для різних довірених доменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:4007 sssd.conf.5.xml:3999
 msgid "Special value 0 implies that this feature is disabled."
 msgstr "Спеціальне значення 0 означає, що цю можливість вимкнено."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:4011 sssd.conf.5.xml:4003
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5719,12 +5766,12 @@ msgstr ""
 "обробки <quote>initgroups</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:4022 sssd.conf.5.xml:4014
 msgid "local_auth_policy (string)"
 msgstr "local_auth_policy (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:4025 sssd.conf.5.xml:4017
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5744,7 +5791,7 @@ msgstr ""
 "методи, обробка і перевірка у яких відбуватиметься локально."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4037 sssd.conf.5.xml:4029
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5764,7 +5811,7 @@ msgstr ""
 "<quote>enable:passkey, enable:smartcard</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4050 sssd.conf.5.xml:4042
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5775,42 +5822,43 @@ msgstr ""
 "при типовому значенні local_auth_policy: <quote>match</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4055
 msgid "local_auth_policy = match (default)"
 msgstr "local_auth_policy = match (типове значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4064 sssd.conf.5.xml:4056
 msgid "Passkey"
 msgstr "Ключ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4065 sssd.conf.5.xml:4057
 msgid "Smartcard"
 msgstr "Картка пам'яті"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189 sssd.conf.5.xml:4060
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194 sssd.conf.5.xml:4063
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
 #: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4066 sssd.conf.5.xml:4067
 msgid "disabled"
 msgstr "вимкнено"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4074 sssd.conf.5.xml:4066
 msgid "LDAP"
 msgstr "LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4079 sssd.conf.5.xml:4071
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5824,7 +5872,7 @@ msgstr ""
 "наприклад, запиту щодо пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4091 sssd.conf.5.xml:4083
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5840,7 +5888,7 @@ msgstr ""
 "local_auth_policy = only\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4087 sssd.conf.5.xml:4079
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5851,7 +5899,7 @@ msgstr ""
 "smartcard, passkey).  <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4099 sssd.conf.5.xml:4091
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
@@ -5860,22 +5908,22 @@ msgstr ""
 "local_auth_policy і підтримує типово розпізнавання за карткою пам'яті."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4104 sssd.conf.5.xml:4096
 msgid "Default: match"
 msgstr "Типове значення: match"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4109 sssd.conf.5.xml:4101
 msgid "auto_private_groups (string)"
 msgstr "auto_private_groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4115 sssd.conf.5.xml:4107
 msgid "true"
 msgstr "true"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4118 sssd.conf.5.xml:4110
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
@@ -5884,7 +5932,7 @@ msgstr ""
 "користувача. У цьому випадку номер GID буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4122 sssd.conf.5.xml:4114
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5897,12 +5945,12 @@ msgstr ""
 "примусово встановлює унікальність записів у просторі ідентифікаторів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4131 sssd.conf.5.xml:4123
 msgid "false"
 msgstr "false"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4134 sssd.conf.5.xml:4126
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
@@ -5911,12 +5959,12 @@ msgstr ""
 "вказувати на об'єкт групи у базі даних LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4140 sssd.conf.5.xml:4132
 msgid "hybrid"
 msgstr "hybrid"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4143 sssd.conf.5.xml:4135
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5931,7 +5979,7 @@ msgstr ""
 "цього користувача визначатиме цей об'єкт групи."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4156 sssd.conf.5.xml:4148
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
@@ -5940,7 +5988,7 @@ msgstr ""
 "групи, інакше надійне визначення GID буде просто неможливим."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4163 sssd.conf.5.xml:4155
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5951,7 +5999,7 @@ msgstr ""
 "збереженням наявних приватних груп для користувачів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4112 sssd.conf.5.xml:4104
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -5960,7 +6008,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4175 sssd.conf.5.xml:4167
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
@@ -5970,7 +6018,7 @@ msgstr ""
 "використовується автоматична прив'язка до ідентифікаторів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4183 sssd.conf.5.xml:4175
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5980,7 +6028,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4189 sssd.conf.5.xml:4181
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5992,7 +6040,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4180 sssd.conf.5.xml:4172
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -6006,7 +6054,7 @@ msgstr ""
 "subdomain_inherit: <placeholder type=\"programlisting\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2579 sssd.conf.5.xml:2577
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -6017,17 +6065,17 @@ msgstr ""
 "quote> <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4204 sssd.conf.5.xml:4196
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4207 sssd.conf.5.xml:4199
 msgid "The proxy target PAM proxies to."
 msgstr "Комп’ютер, для якого виконує проксі-сервер PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4210 sssd.conf.5.xml:4202
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -6039,12 +6087,12 @@ msgstr ""
 "local_auth_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4220 sssd.conf.5.xml:4212
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4223 sssd.conf.5.xml:4215
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -6055,12 +6103,12 @@ msgstr ""
 "наприклад _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4233 sssd.conf.5.xml:4225
 msgid "proxy_resolver_lib_name (string)"
 msgstr "proxy_resolver_lib_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4236 sssd.conf.5.xml:4228
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -6071,12 +6119,12 @@ msgstr ""
 "_nss_$(назва_бібліотеки)_$(функція), наприклад _nss_dns_gethostbyname2_r."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4247 sssd.conf.5.xml:4239
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4250 sssd.conf.5.xml:4242
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -6091,12 +6139,12 @@ msgstr ""
 "у кеші, щоб пришвидшити надання результатів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4264 sssd.conf.5.xml:4256
 msgid "proxy_max_children (integer)"
 msgstr "proxy_max_children (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4267 sssd.conf.5.xml:4259
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -6108,7 +6156,7 @@ msgstr ""
 "використання черги запитів."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4200 sssd.conf.5.xml:4192
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -6117,12 +6165,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4283 sssd.conf.5.xml:4275
 msgid "Application domains"
 msgstr "Домени програм (application)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4285 sssd.conf.5.xml:4277
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -6150,7 +6198,7 @@ msgstr ""
 "який може успадковувати параметр з традиційного домену SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4305 sssd.conf.5.xml:4297
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -6161,17 +6209,17 @@ msgstr ""
 "його доменом-близнюком у POSIX має бути встановлено належним чином."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4311 sssd.conf.5.xml:4303
 msgid "Application domain parameters"
 msgstr "Параметри доменів програм"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4313 sssd.conf.5.xml:4305
 msgid "inherit_from (string)"
 msgstr "inherit_from (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4316 sssd.conf.5.xml:4308
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -6183,7 +6231,7 @@ msgstr ""
 "розширюють або перевизначають параметри домену-<quote>близнюка</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4330 sssd.conf.5.xml:4322
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -6198,7 +6246,7 @@ msgstr ""
 "у кеші і робить атрибут phone доступним через інтерфейс D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4338 sssd.conf.5.xml:4330
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6232,12 +6280,12 @@ msgstr ""
 "ldap_user_extra_attrs = phone:telephoneNumber\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4358 sssd.conf.5.xml:4350
 msgid "TRUSTED DOMAIN SECTION"
 msgstr "РОЗДІЛ ДОВІРЕНИХ ДОМЕНІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4360 sssd.conf.5.xml:4352
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -6255,57 +6303,57 @@ msgstr ""
 "такі параметри:"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4367 sssd.conf.5.xml:4359
 msgid "ldap_search_base,"
 msgstr "ldap_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4368 sssd.conf.5.xml:4360
 msgid "ldap_user_search_base,"
 msgstr "ldap_user_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4369 sssd.conf.5.xml:4361
 msgid "ldap_group_search_base,"
 msgstr "ldap_group_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4370 sssd.conf.5.xml:4362
 msgid "ldap_netgroup_search_base,"
 msgstr "ldap_netgroup_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4371 sssd.conf.5.xml:4363
 msgid "ldap_service_search_base,"
 msgstr "ldap_service_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4372 sssd.conf.5.xml:4364
 msgid "ldap_sasl_mech,"
 msgstr "ldap_sasl_mech,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4373 sssd.conf.5.xml:4365
 msgid "ad_server,"
 msgstr "ad_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4374 sssd.conf.5.xml:4366
 msgid "ad_backup_server,"
 msgstr "ad_backup_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4375 sssd.conf.5.xml:4367
 msgid "ad_site,"
 msgstr "ad_site,"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884 sssd.conf.5.xml:4368
 msgid "use_fully_qualified_names"
 msgstr "use_fully_qualified_names"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4380 sssd.conf.5.xml:4372
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
@@ -6314,12 +6362,12 @@ msgstr ""
 "підручника."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4386 sssd.conf.5.xml:4378
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr "РОЗДІЛ ПРИВ'ЯЗКИ СЕРТИФІКАТІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4388 sssd.conf.5.xml:4380
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -6342,7 +6390,7 @@ msgstr ""
 "використовують для розпізнавання PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4402 sssd.conf.5.xml:4394
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -6354,7 +6402,7 @@ msgstr ""
 "citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4411 sssd.conf.5.xml:4403
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -6367,12 +6415,12 @@ msgstr ""
 "replaceable>]</quote>. У цьому розділі можна використовувати такі параметри:"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4418 sssd.conf.5.xml:4410
 msgid "matchrule (string)"
 msgstr "matchrule (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4421 sssd.conf.5.xml:4413
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
@@ -6381,7 +6429,7 @@ msgstr ""
 "цьому правилу. Усі інші сертифікати буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4425 sssd.conf.5.xml:4417
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
@@ -6391,17 +6439,17 @@ msgstr ""
 "<quote>clientAuth</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4432 sssd.conf.5.xml:4424
 msgid "maprule (string)"
 msgstr "maprule (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4435 sssd.conf.5.xml:4427
 msgid "Defines how the user is found for a given certificate."
 msgstr "Визначає спосіб пошуку користувача для вказаного сертифіката."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4441 sssd.conf.5.xml:4433
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
@@ -6410,7 +6458,7 @@ msgstr ""
 "даних, зокрема <quote>ldap</quote>, <quote>AD</quote> та <quote>ipa</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4447 sssd.conf.5.xml:4439
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
@@ -6419,12 +6467,12 @@ msgstr ""
 "запис користувача і такою самою назвою."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4456 sssd.conf.5.xml:4448
 msgid "domains (string)"
 msgstr "domains (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4459 sssd.conf.5.xml:4451
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -6437,17 +6485,17 @@ msgstr ""
 "параметр можна використати і для додавання правила до піддоменів."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4466 sssd.conf.5.xml:4458
 msgid "Default: the configured domain in sssd.conf"
 msgstr "Типове значення: домен, який налаштовано у sssd.conf"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4471 sssd.conf.5.xml:4463
 msgid "priority (integer)"
 msgstr "priority (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4474 sssd.conf.5.xml:4466
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -6458,12 +6506,12 @@ msgstr ""
 "пріоритетність, а <quote>4294967295</quote> — найнижча."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4480 sssd.conf.5.xml:4472
 msgid "Default: the lowest priority"
 msgstr "Типове значення: найнижча пріоритетність"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4486 sssd.conf.5.xml:4478
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
@@ -6473,7 +6521,7 @@ msgstr ""
 "спеціальних властивостей:"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4492 sssd.conf.5.xml:4484
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
@@ -6482,7 +6530,7 @@ msgstr ""
 "відповідного облікового запису користувача"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4498 sssd.conf.5.xml:4490
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -6495,17 +6543,17 @@ msgstr ""
 "quote> або <quote>({назва_об'єкта_rfc822.коротка_назва})</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4507 sssd.conf.5.xml:4499
 msgid "the <quote>domains</quote> option is ignored"
 msgstr "параметр <quote>domains</quote> буде проігноровано"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4515 sssd.conf.5.xml:4507
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr "РОЗДІЛ НАЛАШТОВУВАННЯ ЗАПИТІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4517 sssd.conf.5.xml:4509
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -6521,7 +6569,7 @@ msgstr ""
 "реєстраційних даних."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4525 sssd.conf.5.xml:4517
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -6535,22 +6583,22 @@ msgstr ""
 "випадках мають забезпечити описані нижче параметри."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4537 sssd.conf.5.xml:4529
 msgid "[prompting/password]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4540 sssd.conf.5.xml:4532
 msgid "password_prompt"
 msgstr "password_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4541 sssd.conf.5.xml:4533
 msgid "to change the string of the password prompt"
 msgstr "для зміни рядка запиту пароля"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4539 sssd.conf.5.xml:4531
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6559,37 +6607,37 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4549 sssd.conf.5.xml:4541
 msgid "[prompting/2fa]"
 msgstr "[prompting/2fa]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4553 sssd.conf.5.xml:4545
 msgid "first_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4554 sssd.conf.5.xml:4546
 msgid "to change the string of the prompt for the first factor"
 msgstr "для зміни рядка запиту для першого фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4557 sssd.conf.5.xml:4549
 msgid "second_prompt"
 msgstr "second_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4558 sssd.conf.5.xml:4550
 msgid "to change the string of the prompt for the second factor"
 msgstr "для зміни рядка запиту для другого фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4561 sssd.conf.5.xml:4553
 msgid "single_prompt"
 msgstr "single_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4562 sssd.conf.5.xml:4554
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -6602,7 +6650,7 @@ msgstr ""
 "якщо другий фактор не є обов'язковим."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4551 sssd.conf.5.xml:4543
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -6615,17 +6663,17 @@ msgstr ""
 "паролем, або за двома факторами, має бути використано двокроковий запит."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4579 sssd.conf.5.xml:4571
 msgid "[prompting/passkey]"
 msgstr "[prompting/passkey]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021 sssd.conf.5.xml:4577
 msgid "interactive"
 msgstr "interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4587 sssd.conf.5.xml:4579
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -6636,22 +6684,22 @@ msgstr ""
 "тактильного перемикача."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4595 sssd.conf.5.xml:4587
 msgid "interactive_prompt"
 msgstr "interactive_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4597 sssd.conf.5.xml:4589
 msgid "to change the message of the interactive prompt."
 msgstr "для зміни повідомлення інтерактивного запиту."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4602 sssd.conf.5.xml:4594
 msgid "touch"
 msgstr "touch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4604 sssd.conf.5.xml:4596
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
@@ -6660,17 +6708,17 @@ msgstr ""
 "користувачеві щодо потреби торкнутися пристрою."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4610 sssd.conf.5.xml:4602
 msgid "touch_prompt"
 msgstr "touch_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4612 sssd.conf.5.xml:4604
 msgid "to change the message of the touch prompt."
 msgstr "для зміни повідомлення запиту щодо торкання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4581 sssd.conf.5.xml:4573
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -6679,7 +6727,7 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4532 sssd.conf.5.xml:4524
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -6692,7 +6740,7 @@ msgstr ""
 "type=\"variablelist\" id=\"1\"/><placeholder type=\"variablelist\" id=\"2\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4623 sssd.conf.5.xml:4615
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -6704,11 +6752,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4622
 msgid "EXAMPLES"
 msgstr "ПРИКЛАДИ"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4636 sssd.conf.5.xml:4628
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6760,7 +6809,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4632 sssd.conf.5.xml:4624
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6773,7 +6822,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4668 sssd.conf.5.xml:4660
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6783,7 +6832,7 @@ msgstr ""
 "use_fully_qualified_names = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4662 sssd.conf.5.xml:4654
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6800,7 +6849,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4679 sssd.conf.5.xml:4671
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6816,7 +6865,7 @@ msgstr ""
 "priority = 10\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4673 sssd.conf.5.xml:4665
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -23284,6 +23333,24 @@ msgstr ""
 "Визначає, чи слід перетворювати реєстраційний запис вузла і користувача у "
 "канонічну форму. Цю можливість передбачено з версії MIT Kerberos 1.7."
 
+#. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:601
+msgid ""
+"If a Certificate Revocation List (CRL)  is expired ignore the CRL checks for "
+"the related certificates. This option should be used to allow authentication "
+"when the system is offline and the CRL cannot be renewed."
+msgstr ""
+"Якщо строк дії списку відкликання сертифікатів (CRL) вичерпано, перевірки "
+"CRL для відповідних сертифікатів буде проігноровано. Цим параметром слід "
+"користуватися для уможливлення розпізнавання у системах, які працюють у "
+"автономному режимі, коли оновлення CRL є неможливим."
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:2684
+msgid "Feature is only supported for domains with id_provider = ldap."
+msgstr ""
+"Підтримку можливості передбачено лише для доменів з id_provider = ldap."
+
 #~ msgid ""
 #~ "<filename>sssd.conf</filename> must be a regular file that is owned, "
 #~ "readable, and writeable by '&sssd_user_name;' user (if SSSD is configured "

From f09a66cacc4e82dc15557d1c7552f469a3a47629 Mon Sep 17 00:00:00 2001
From: Elena Mishina <lepata@basealt.ru>
Date: Tue, 24 Sep 2024 08:08:32 +0000
Subject: [PATCH 047/129] po: update translations

(Russian) currently translated at 100.0% (2792 of 2792 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ru/
---
 src/man/po/ru.po | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/man/po/ru.po b/src/man/po/ru.po
index b333dd1995c..cd431550d3b 100644
--- a/src/man/po/ru.po
+++ b/src/man/po/ru.po
@@ -9,7 +9,7 @@ msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
 "POT-Creation-Date: 2024-06-25 13:25+0200\n"
-"PO-Revision-Date: 2024-07-17 21:38+0000\n"
+"PO-Revision-Date: 2024-09-24 08:39+0000\n"
 "Last-Translator: Elena Mishina <lepata@basealt.ru>\n"
 "Language-Team: Russian <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-manpage-master/ru/>\n"
@@ -19,7 +19,7 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
 "n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
-"X-Generator: Weblate 5.6.2\n"
+"X-Generator: Weblate 5.7.2\n"
 
 #. type: Content of: <reference><title>
 #: sssd.conf.5.xml:8 sssd-ldap.5.xml:5 pam_sss.8.xml:5 pam_sss_gss.8.xml:5
@@ -2524,7 +2524,7 @@ msgstr "pam_passkey_auth (логическое значение)"
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1682 sssd.conf.5.xml:1680
 msgid "Enable passkey device based authentication."
-msgstr "Включите аутентификацию на основе ключа доступа."
+msgstr "Включить аутентификацию на основе ключа доступа."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271

From 2eef90a0c0d3409c24f986e1b5826eb30268ea5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Tue, 15 Oct 2024 11:43:44 +0200
Subject: [PATCH 048/129] po: fix sv language

---
 po/sv.po | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/po/sv.po b/po/sv.po
index b422b042963..04d70495ef8 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -2782,7 +2782,7 @@ msgstr "Kan inte ta reda på GPO:ns bas-DN\n"
 #: src/tools/sssctl/sssctl_cache.c:890
 #, c-format
 msgid "Unable to search sysdb: %s\n"
-msgstr "Kan inte söka i sysdb\n"
+msgstr "Kan inte söka i sysdb: %s\n"
 
 #: src/tools/sssctl/sssctl_cache.c:896
 #, c-format

From 6ec5aa0da65371a2b20bc4ab96b8326364b61fdc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Tue, 15 Oct 2024 11:45:49 +0200
Subject: [PATCH 049/129] pot: update pot files

---
 po/bg.po                 | 1131 ++++++++--------
 po/ca.po                 | 1132 ++++++++--------
 po/cs.po                 | 1131 ++++++++--------
 po/de.po                 | 1131 ++++++++--------
 po/es.po                 | 1133 ++++++++--------
 po/eu.po                 | 1128 ++++++++--------
 po/fi.po                 | 1131 ++++++++--------
 po/fr.po                 | 1161 +++++++++--------
 po/hu.po                 | 1128 ++++++++--------
 po/id.po                 | 1131 ++++++++--------
 po/it.po                 | 1131 ++++++++--------
 po/ja.po                 | 1131 ++++++++--------
 po/ka.po                 | 1128 ++++++++--------
 po/ko.po                 | 1131 ++++++++--------
 po/nb.po                 | 1128 ++++++++--------
 po/nl.po                 | 1131 ++++++++--------
 po/pl.po                 | 1131 ++++++++--------
 po/pt.po                 | 1131 ++++++++--------
 po/pt_BR.po              | 1128 ++++++++--------
 po/ru.po                 | 1131 ++++++++--------
 po/sssd.pot              | 1128 ++++++++--------
 po/sv.po                 | 1137 ++++++++--------
 po/tg.po                 | 1128 ++++++++--------
 po/tr.po                 | 1131 ++++++++--------
 po/uk.po                 | 1137 ++++++++--------
 po/zh_CN.po              | 1131 ++++++++--------
 po/zh_TW.po              | 1128 ++++++++--------
 src/man/po/br.po         | 2489 ++++++++++++++++++-----------------
 src/man/po/ca.po         | 2523 ++++++++++++++++++-----------------
 src/man/po/cs.po         | 2497 ++++++++++++++++++-----------------
 src/man/po/de.po         | 2539 +++++++++++++++++++-----------------
 src/man/po/es.po         | 2544 +++++++++++++++++++-----------------
 src/man/po/eu.po         | 2489 ++++++++++++++++++-----------------
 src/man/po/fi.po         | 2491 ++++++++++++++++++-----------------
 src/man/po/fr.po         | 2526 ++++++++++++++++++-----------------
 src/man/po/ja.po         | 2515 ++++++++++++++++++-----------------
 src/man/po/lv.po         | 2489 ++++++++++++++++++-----------------
 src/man/po/nl.po         | 2503 ++++++++++++++++++-----------------
 src/man/po/pt.po         | 2505 ++++++++++++++++++-----------------
 src/man/po/pt_BR.po      | 2489 ++++++++++++++++++-----------------
 src/man/po/ru.po         | 2683 ++++++++++++++++++++------------------
 src/man/po/sssd-docs.pot | 2481 ++++++++++++++++++-----------------
 src/man/po/sv.po         | 2641 +++++++++++++++++++------------------
 src/man/po/tg.po         | 2489 ++++++++++++++++++-----------------
 src/man/po/uk.po         | 2678 +++++++++++++++++++------------------
 src/man/po/zh_CN.po      | 2489 ++++++++++++++++++-----------------
 46 files changed, 40311 insertions(+), 38307 deletions(-)

diff --git a/po/bg.po b/po/bg.po
index a843fe21213..41c7c76fa91 100644
--- a/po/bg.po
+++ b/po/bg.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:44-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Bulgarian (http://www.transifex.com/projects/p/sssd/language/"
@@ -46,26 +46,22 @@ msgid "Command to start service"
 msgstr "Команда за стартиране на услугата"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Време за опити за връзка с Data Provider-и"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -73,63 +69,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD услуги за стартиране"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD домейни за стартиране"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Regex за намиране на потребителско име и домейн"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Printf-съвместим формат за изобразяване на пълно-квалифицирани имена"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -137,133 +133,133 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Потребители, които SSSD изрично трябва да игнорира"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Групи, които SSSD изрично трябва да игнорира"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Да се показват ли филтрираните потребители в групи"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Стойността на полето парола, което NSS доставчикът трябва да върне"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr "Колко дни да се позволява кеширано влизане между влизания онлайн"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Колко неуспешни опита за влизане са разрешени, когато сме офлайн"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -271,1003 +267,1009 @@ msgstr ""
 "Колко време (в минути) да е забранено влизането, след достигане броя "
 "неуспешни опити за влизане, когато сме офлайн"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Изисква TLS проверка на сертификат"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Доставчик на самоличност"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Доставчик на удостоверяване"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Доставчик на контрол на достъп"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Доставчик на смяна на парола"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "Разреши проверката на данните за удостоверяване"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Минимално ID на потребител"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Максимално ID на потребител"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Кеширай идентификационни данни за офлайн влизане"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Показвай потребители/групи в пълно -валифицирана форма"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr "Ограничава или предпочита определена фамилия адреси при DNS търсения"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Колко дни да се пазят кешираните записи след последното успешно влизане"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Колко време да чакам за отговори от DNS при търсене на сървъри (секунди)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Частта Домейн от DNS заявката за откриване на услуга"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "Интерфейсът, чийто IP да се ползва за динамични DNS обновявания"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA домейн"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Адрес на IPA сървър"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Име на хост на IPA клиент"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "Дали автоматично да се обновява клиентския DNS запис във FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "LDAP филтър за определяне права на достъп"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Адрес на Kerberos сървър"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos област"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Директория за съхранение на кеша за данни за удостоверяване"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Местоположение на кеша за данни за удостоверяване на потребители"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Местоположение на keytab за валидиране на данните за удостоверяване"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Разреши проверката на данните за удостоверяване"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "Записва паролата ако е офлайн за по-късно удостоверяване"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "Сървърът, на който работи услугата за смяна на парола ако не е на KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, URI на LDAP сървъра"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Базовият DN по подразбиране"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Използваният тип схема на LDAP сървъра, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Подразбиращият се bind DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Продължителност на опитите за свързване"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Продължителност на опитите за синхронни LDAP операции"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Продължителност на времето между опитите за връзка докато е офлайн"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Файл, съдържащ CA сертификати"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Път до директорията на CA сертификат"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Изисква TLS проверка на сертификат"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Задава за използване механизма sasl"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Задаване на sasl authorization id за употреба"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "keytab на Kerberos услуга"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Ползвай Kerberos auth за LDAP връзка"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Следвай LDAP референциите"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Продължителност на живот на TGT за LDAP връзка"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Продължителност на време за изчакване на заявка за търсене"
@@ -1852,32 +1854,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Продължава като демон (по подразбиране)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Интерактивна работа (а не като демон)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1885,97 +1887,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2008,140 +2010,140 @@ msgstr "Възникнала е грешка, но не може да се на
 msgid "Unexpected error while looking for an error description"
 msgstr "Неочаквана грешка при търсене на описание на грешка"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Съобщение от сървъра:"
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Паролите не съвпадат"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Промяна на паролата от root не се поддържа."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Удостоверен с кеширани идентификационни данни"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", кешираната парола ще изтече на: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr ", кешираната парола ще изтече на: "
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Удостоверяването е забранено до: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Системата е офлайн, промяна на паролата не е възможна"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Промяната на паролата не успя."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Нова парола:"
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Отново новата парола:"
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Парола:"
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Текуща парола:"
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Паролата Ви е остаряла. Сменете я сега."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Нивото на debug записи при работа"
 
@@ -2150,7 +2152,7 @@ msgstr "Нивото на debug записи при работа"
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Грешка при задаване локални настр.\n"
 
@@ -2212,102 +2214,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2341,163 +2347,163 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Не мога да получа инфо за потребителя\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Не мога да получа инфо за потребителя\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2552,7 +2558,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2566,211 +2572,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2779,42 +2785,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2836,284 +2842,284 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA домейн"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "атрибут UID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Доставчик на удостоверяване"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "SSSD не е стартиран като root."
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3176,19 +3182,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3197,124 +3203,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Задаване на друг (не подразбиращия се) конфиг файл"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Време за опити за връзка с Data Provider-и"
+
 #~ msgid "Timeout for messages sent over the SBUS"
 #~ msgstr "Изчакване за съобщения, изпратени през SBUS"
 
diff --git a/po/ca.po b/po/ca.po
index e8d907f4945..9c776f6f540 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2017-10-15 03:02-0400\n"
 "Last-Translator: Robert Antoni Buj Gelonch <rbuj@fedoraproject.org>\n"
 "Language-Team: Catalan (http://www.transifex.com/projects/p/sssd/language/"
@@ -53,28 +53,24 @@ msgid "Command to start service"
 msgstr "L'ordre per iniciar el servei"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "El nombre de vegades per intentar la connexió als proveïdors de dades"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "El nombre de descriptors de fitxers que poden estar oberts per aquest "
 "contestador"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "El temps d'inactivitat abans de la desconnexió automàtica d'un client"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -82,23 +78,23 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Els serveis del SSSD a iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Els dominis del SSSD a iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "L'expressió regular per analitzar el nom d'usuari i el domini"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Format compatible amb printf per mostrar els FQN"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -106,43 +102,43 @@ msgstr ""
 "El directori del sistema de fitxers on el SSSD ha d'emmagatzemar els fitxers "
 "de la memòria cau de repetició de Kerberos."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "El domini per afegir als noms sense un component de domini."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "L'usuari a qui se li disminueixen els permisos"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Tots els espais, als noms dels grups o dels usuaris, se substituiran amb "
 "aquest caràcter"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -150,87 +146,87 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 "Període de temps per a l'expiració de la memòria cau de les enumeracions (en "
 "segons)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 "Període de temps per a l'expiració de l'actualització en rerefons de les "
 "entrades de la memòria cau (en segons)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 "Període de temps per a l'expiració de la memòria cau negativa (en segons)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Els usuaris que l'SSSD hauria d'ignorar explícitament"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Els grups que l'SSSD hauria d'ignorar explícitament"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Si els usuaris filtrats han d'aparèixer als grups"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 "El valor del camp de la contrasenya que ha de retornar el proveïdor NSS"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Substitueix el valor de homedir del proveïdor d'identitat amb aquest valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Substitueix el valor buit de homedir del proveïdor d'identitat amb aquest "
 "valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 "Substitueix el valor del shell del proveïdor d'identitat amb aquest valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 "La llista dels shells que els usuaris poden utilitzar per iniciar la sessió"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "La llista dels shells que es vetaran i se substituiran amb el shell "
 "alternatiu"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -238,64 +234,64 @@ msgstr ""
 "Si un shell emmagatzemat al directori central està permès però no es troba "
 "disponible, utilitza aquesta alternativa"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "El shell a utilitzar si el proveïdor no en llista cap"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Quant de temps seran vàlids els registres a la memòria cau"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Quant de temps s'ha de permetre entre els inicis de sessions en memòria cau "
 "i els inicis de sessions en línia (en dies)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 "Quants intents fallits d'inicis de sessió es permeten quan s'està "
 "desconnectat"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -303,128 +299,128 @@ msgstr ""
 "Quant de temps (en minuts) s'ha de denegar l'inici de sessió després d'haver "
 "assolit offline_failed_login_attempts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "Quins tipus de missatges es mostren a l'usuari durant l'autenticació"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Quants segons s'ha de mantenir la informació en la memòria cau per a les "
 "peticions PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 "Quants dies abans del venciment de la contrasenya s'hauria de mostrar una "
 "advertència"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "La llista dels uid o dels noms d'usuari de confiança"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 "La llista dels dominis accessibles fins i tot per als usuaris que no són de "
 "confiança."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "El missatge que es mostra quan venç el compte de l'usuari."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Requereix verificació de certificat TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "Si s'avaluen els atributs basats en temps a les regles sudo"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "Si s'esbocinen els noms i les adreces dels amfitrions al fitxer known_hosts"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -432,348 +428,348 @@ msgstr ""
 "Quants segons s'ha de mantenir un amfitrió al fitxer known_hosts després que "
 "s'hagi sol·licitat la seva clau"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "La llista dels UID o dels noms d'usuari que poden accedir al contestador del "
 "PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "La llista dels atributs de l'usuari que l'InfoPipe pot publicar"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Proveïdor d'identitat"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Proveïdor d'autenticació"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Proveïdor de control d'accés"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Proveïdor de canvi de contrasenya"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Proveïdor de SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Proveïdor d'Autofs"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Proveïdor d'identitat d'amfitrions"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "Habilita la validació de credencials"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Id. mínim d'usuari"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Id. màxim d'usuari"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Habilita l'enumeració de tots els usuaris/grups"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Credencials en memòria cau per als inicis de sessions sense connexió"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Mostra els usuaris/grups en format plenament qualificat"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "No incloure als membres dels grups en la recerca del grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 "Període de temps per a l'expiració de les entrades de la memòria cau (en "
 "segons)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Restringeix o prefereix una família específica d'adreces quan es realitzi la "
 "recerca del DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Quant de temps s'han de mantenir les entrades en la memòria cau després de "
 "l'últim inici de sessió reeixit (en dies)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Temps d'expiració per a les respostes del DNS en la resolució dels servidors "
 "(en segons)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "La part del domini de la consulta DNS del descobriment del servei"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 "Substitueix el valor del GID del proveïdor d'identitat amb aquest valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Distingeix entre majúscules i minúscules als noms d'usuari"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Amb quina freqüència les entrades vençudes s'actualitzen al rerefons"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Si s'actualitza automàticament l'entrada DNS del client"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "El TTL per aplicar a l'entrada DNS del client després d'actualitzar-ho"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "La interfície amb la IP que s'hauria d'utilitzar per a les actualitzacions "
 "dinàmiques DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Cada quant s'actualitzarà automàticament l'entrada DNS del client"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 #, fuzzy
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Cada quant s'actualitzarà automàticament l'entrada DNS del client"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "Si el proveïdor ha d'actualitzar explícitament així el registre PTR"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Si la utilitat nsupdate per defecte ha d'utilitzar TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Quin tipus d'autenticació s'ha d'utilitzar per realitzar l'actualització del "
 "DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Control de l'enumeració dels amfitrions de confiança"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Amb quina freqüència s'ha de refrescar la llista dels subdominis"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Llista de les opcions que han de ser inherents a un subdomini"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Domini IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Adreça del servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adreça del servidor IPA de reserva "
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Nom d'amfitrió del client IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "Si s'actualitza automàticament l'entrada DNS del client a FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Base de cerca per als objectes relacionats amb HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 "Quantitat de temps entre recerques de les regles HBAC contra el servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
@@ -781,237 +777,237 @@ msgstr ""
 "Quantitat de temps en segons entre recerques de les assignacions SELinux "
 "contra el servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Si s'estableix a fals, s'ignorarà l'argument de l'amfitrió proporcionat amb "
 "PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 "La ubicació de l'eina de muntatge automàtic que aquest client IPA està "
 "utilitzant"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 "Base de cerca per a l'objecte que conté la informació sobre el domini de "
 "l'IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 "Base de cerca per als objectes que contenen informació sobre els intervals "
 "d'id."
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 "Habilita els llocs DNS - el descobriment del servei es basa en la ubicació"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Base de cerca per als contenidors de la vista"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Objectclass per als contenidors de la vista"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "L'atribut amb el nom de la vista"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Objectclass per substituir els objectes"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "L'atribut amb la referència a l'objecte original"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Objectclass per als objectes de substitució d'usuari"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Objectclass per als objectes de substitució de grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 #, fuzzy
 msgid "Search base for SUBID ranges"
 msgstr "Base de cerca per als contenidors de la vista"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Quines regles s'haurien d'utilitzar per avaluar el control d'accés"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Domini Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Adreça del servidor de l'Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Adreça del servidor de l'Active Directory de reserva"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Nom d'amfitrió del client d'Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Filtre LDAP per determinar els privilegis d'accés"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Si s'utilitza el catàleg global per a les recerques"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Mode d'operació per al control d'accés basat en GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
@@ -1019,7 +1015,7 @@ msgstr ""
 "Quantitat de temps entre recerques de fitxers de polítiques GPO contra el "
 "servidor d'AD"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
@@ -1027,7 +1023,7 @@ msgstr ""
 "Noms dels serveis del PAM que s'assignen als ajusts de les polítiques "
 "(Deny)InteractiveLogonRight del GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1035,297 +1031,297 @@ msgstr ""
 "Noms dels serveis del PAM que s'assignen als ajusts de les polítiques "
 "(Deny)RemoteInteractiveLogonRight del GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "Noms dels serveis del PAM que s'assignen als ajusts de les polítiques "
 "(Deny)NetworkLogonRight del GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "Noms dels serveis del PAM que s'assignen als ajusts de les polítiques "
 "(Deny)BatchLogonRight del GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "Noms dels serveis del PAM que s'assignen als ajusts de les polítiques "
 "(Deny)ServiceLogonRight del GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 "Noms dels serveis del PAM als quals sempre se'ls garanteix l'accés basat en "
 "GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 "Noms dels serveis del PAM als quals sempre se'ls denega l'accés basat en GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Dret (permet o denega) predeterminat de l'inici de sessió a utilitzar per "
 "als noms dels serveis del PAM sense assignar"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "un lloc determinat per utilitzar amb el client"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Adreça del servidor Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Adreça del servidor Kerberos de reserva"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Reialme Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Temps d'expiració de l'autenticació"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Si es creen els fitxers kdcinfo"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Si es rebutgen les parts de la configuració del krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Directori per emmagatzemar la memòria cau de les credencials"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Ubicació de la memòria cau de les credencials de l'usuari"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Ubicació de la clau per validar les credencials"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Habilita la validació de credencials"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "Emmagatzema la contrasenya si s'està desconnectat per a l'autenticació "
 "posterior amb connexió"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Temps de vida renovable del TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Temps de vida del TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Temps entre les dues comprovacions per a la renovació"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Habilita FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Selecciona el principal per utilitzar amb FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Habilita la canonització del principal"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Habilita els principals empresarials"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Servidor on es troba el servei de canvi de contrasenya si no està al KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, L'URI del servidor LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, L'URI del servidor LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "El DN base per defecte"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "El tipus d'esquema en ús al servidor LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "El DN de creació del vincle per defecte"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 "El tipus del testimoni d'autenticació del DN de creació del vincle per "
 "defecte"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "El testimoni d'autenticació del DN de creació del vincle per defecte"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Període de temps per intentar una connexió"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Període de temps per intentar operacions LDAP asíncrones"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 "Període de temps entre els intents per tornar a connectar mentre s'està "
 "desconnectat"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Utilitza només majúscules pels noms de reialme"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Fitxer que conté els certificats de l'AC"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Camí al directori del certificat de l'AC"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Fitxer que conté el certificat de client"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Fitxer que conté la clau de client"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Llista de paquets de xifrat possibles"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Requereix verificació de certificat TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Especifica el mecanisme SASL a utilitzar"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Especifica l'id. d'autorització SASL a utilitzar"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Especifica el reialme d'autorització SASL a utilitzar"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Especifica el SSF mínim per a l'autorització SASL de LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Taula de claus del servei del Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Utilitza l'autenticació Kerberos per a la connexió LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Segueix les referències LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Temps de vida del TGT per la connexió LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Com desreferenciar els àlies"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Nom del servei per a la recerca del servei del DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "El nombre de registres a recuperar en una sola consulta LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "El nombre de membres que han de faltar per activar una de-referència completa"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1333,38 +1329,44 @@ msgstr ""
 "Si la biblioteca LDAP hauria de realitzar una recerca inversa per canonitzar "
 "el nom d'amfitrió durant la creació del vincle SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "L'atribut entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "L'atribut lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "Quant de temps s'ha de retenir una connexió al servidor LDAP abans de "
 "desconnectar"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Inhabilita el control de paginació LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Inhabilita la recuperació de l'interval de l'Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Període de temps per esperar una petició de cerca"
@@ -1972,33 +1974,33 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "L'ordre post-delete ha fallat: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Esdevé un dimoni (per defecte)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Executa en mode interactiu (no com a dimoni)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Imprimeix el número de versió i surt"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -2006,97 +2008,97 @@ msgid ""
 "\n"
 msgstr "L'ordre post-delete ha fallat: %1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Sense memòria\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Un descriptor de fitxer obert pels registres de depuració"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "L'usuari amb què es crea la ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "El grup amb què es crea la ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domini del proveïdor d'informació (obligatori)"
 
@@ -2130,67 +2132,67 @@ msgstr "S'ha produït un error però no s'ha pogut trobar cap descripció."
 msgid "Unexpected error while looking for an error description"
 msgstr "Error inesperat en cercar una descripció de l'error"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Permís denegat."
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Missatge del servidor: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Les contrasenyes no coincideixen"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "No s'admet el restabliment de la contrasenya pel root."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "S'ha autenticat amb credencials de la memòria cau"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", la vostra contrasenya en memòria cau vencerà el: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 "La vostra contrasenya ha vençut. Teniu %1$d inicis de sessió restants de "
 "cortesia."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "La vostra contrasenya vencerà en %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "La vostra contrasenya vencerà en %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "S'ha denegat l'autenticació fins: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "El sistema està desconnectat, el canvi de contrasenya no és possible"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2198,76 +2200,76 @@ msgstr ""
 "Després de canviar la contrasenya OTP, heu de tancar la sessió i tornar-la a "
 "iniciar per tal d'adquirir un tiquet"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Ha fallat el canvi de contrasenya."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nova contrasenya: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Torneu a introduir la nova contrasenya: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Primer factor:"
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Segon factor:"
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Contrasenya: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Contrasenya actual: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "La contrasenya ha vençut. Canvieu ara la vostra contrasenya."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "El nivell de depuració amb què s'executa"
 
@@ -2276,7 +2278,7 @@ msgstr "El nivell de depuració amb què s'executa"
 msgid "The SSSD domain to use"
 msgstr "El domini SSSD a utilitzar"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "S'ha produït un error en establir la configuració regional\n"
 
@@ -2338,95 +2340,99 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Cap objecte de la memòria cau ha coincidit amb la cerca especificada\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "No s'ha pogut invalidar %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "No s'ha pogut invalidar %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Invalida un usuari determinat"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Invalida tots els usuaris"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Invalida un grup determinat"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Invalida tots els grups"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Invalida un grup de xarxa determinat"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Invalida tots els grups de xarxa"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Invalida un servei determinat"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Invalida tots els serveis"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Invalida una assignació autofs determinada"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Invalida totes les assignacions autofs"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Invalida un amfitrió SSH determinat"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Invalida tots els amfitrions SSH"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Invalida les entrades només d'un domini determinat"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Si us plau, seleccioneu almenys un objecte a invalidar\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2435,7 +2441,7 @@ msgstr ""
 "No es pot obrir el domini %1$s. Si el domini és un subdomini (domini de "
 "confiança), utilitzeu el FQN en lloc del paràmetre --domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "No s'han pogut obrir els dominis disponibles\n"
 
@@ -2469,166 +2475,166 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 #, fuzzy
 msgid "List available domains"
 msgstr "No s'han pogut obrir els dominis disponibles\n"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 #, fuzzy
 msgid "Print information about domain"
 msgstr "Control de l'enumeració dels amfitrions de confiança"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "No es pot obtenir la informació sobre l'usuari\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 #, fuzzy
 msgid "Invalidate cached objects"
 msgstr "Invalida tots els usuaris"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "No es pot obtenir la informació sobre l'usuari\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2683,7 +2689,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2697,212 +2703,212 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "No s'han pogut obrir els dominis disponibles\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2911,42 +2917,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2968,285 +2974,285 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "Domini IPA"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "L'atribut UID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Proveïdor d'autenticació"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, fuzzy, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "L'ordre post-delete ha fallat: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "L'SSSD no s'està executant com a root."
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 #, fuzzy
 msgid "Target the PAM service"
 msgstr "L'atribut que llista els serveis PAM autoritzats"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3309,19 +3315,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3330,124 +3336,128 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Especifica un fitxer de configuració diferent del predeterminat"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr ""
+#~ "El nombre de vegades per intentar la connexió als proveïdors de dades"
+
 #~ msgid "Privileged socket has wrong ownership or permissions."
 #~ msgstr "El sòcol amb privilegis té malament els permisos o el propietari."
 
diff --git a/po/cs.po b/po/cs.po
index 2b92264cb2b..6d527345581 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-06-22 16:36+0000\n"
 "Last-Translator: Jan Kalabza <jan.kalabza@gmail.com>\n"
 "Language-Team: Czech <https://translate.fedoraproject.org/projects/sssd/sssd-"
@@ -45,28 +45,24 @@ msgid "Command to start service"
 msgstr "Příkaz pro spouštění služy"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Počet pokusů o připojení k poskytovatelům dat"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "Počet popisovačů souborů, které mohou tímto odpovídačem být otevřeny"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Doba nečinnosti, po které dojde k automatickému odpojení klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Doba nečinnosti, po které dojde k vypnutí odpovídače"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 "Vždy dotazovat všechny vyrovnávací paměti před dotazováním poskytovatelů "
 "údajů"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -78,23 +74,23 @@ msgstr ""
 "hodnota je v sekundách a je vypočítávána takto: offilne_timeout (časový "
 "limit pro bez připojení + random_offset (náhodný posun)."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD služby které spustit"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD domény které spustit"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Regulární výraz pro zpracování uživatelského jména a domény"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Formát kompatibilní s printf pro zobrazování úplných názvů"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -102,37 +98,37 @@ msgstr ""
 "Složka na souborovém systému kde by SSSD mělo ukládat soubory pro kerberos "
 "replay."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Doména kterou přidat k názvům bez doménové části."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Uživatel na kterého se stáhnout z oprávnění"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Vyladit ověřování certifikátu"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Všechny mezery v názvech skupin a uživatelských jménech budou nahrazeny "
 "tímto znakem"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "Vyladit sssd aby respektovalo nebo ignorovalo změny stavu netlink"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Zapnout nebo vypnout implicitní doménu založenou na souborech"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Konkrétní pořadí domén ve které je hledat"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -140,7 +136,7 @@ msgstr ""
 "Ovládá zda SSSD má sledovat stav resolv.conf a zjišťovat tak, zda je "
 "zapotřebí aktualizovat svůj vestavěný překlad DNS názvů."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -152,84 +148,84 @@ msgstr ""
 "používat pro toto inotify a pokud toto není možné, náhradně se resolv.conf "
 "dotazovat každých 5 sekund."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "Pro AD a IPA poskytovatele spouštět PAC odpovídač automaticky"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 "Zapnout nebo vypnout diagnostickému zapisování obsahu paměti pro všechny "
 "procesy SSSD."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 #, fuzzy
 msgid "Tune passkey verification behavior"
 msgstr "Vyladit ověřování certifikátu"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Délka časového limitu mezipaměti vyčíslování (v sekundách)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 "Délka časového limitu aktualizace mezipaměti položek na pozadí (v sekundách)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Délka časového limitu záporné mezipaměti (v sekundách)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Délka (v sekundách) časového limitu negativní mezipaměti souborů"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Uživatelé, které by SSSD mělo výslovně ignorovat"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Skupiny, které by SSSD mělo výslovně ignorovat"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Mají se filtrovaní uživatelé objevovat ve skupinách"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Hodnota kolonky hesla kterou by poskytovatel NSS měl vrátit"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Přepsat hodnotu homedir (domovská složka), obdrženou z poskytovatele "
 "identit, touto hodnotou"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Nahradit prázdnou hodnotu homedir z poskytovatele identit touto hodnotou"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 "Přepsat hodnotu shell, obdrženou z poskytovatele identit, touto hodnotou"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 "Seznam uživatelů s přístupem do shellu, kterým je umožněno se přihlásit "
 "pomocí"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "Seznam shellů, které budou vetovány a nahrazeny náhradním"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -237,15 +233,15 @@ msgstr ""
 "Pokud shell uložený v centrálním adresáři je dovolen ale není k dispozici, "
 "použít tuto náhradu"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Shell který použít pokud poskytovatel žádný neuvádí"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Jak dlouho budou záznamy mezipaměti v paměti platné"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -253,7 +249,7 @@ msgstr ""
 "Velikost (v megabajtech) datové tabulky přidělené v rychlé mezipaměti v "
 "operační paměti pro požadavky z passwd"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -261,7 +257,7 @@ msgstr ""
 "Velikost (v megabajtech) datové tabulky přidělené v rychlé mezipaměti v "
 "operační paměti pro požadavky z group"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -269,7 +265,7 @@ msgstr ""
 "Velikost (v megabajtech) datové tabulky přidělené v rychlé mezipaměti v "
 "operační paměti pro požadavky z initgroups"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -277,7 +273,7 @@ msgstr ""
 "Hodnota této volby bude použita v rozšíření volby override_homedir, pokud "
 "šablona obsahuje formátovací řetězec %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -285,7 +281,7 @@ msgstr ""
 "Určuje dobu (v sekundách) po které bude seznam dílčích domén považován za "
 "platný."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -295,17 +291,17 @@ msgstr ""
 "pozadí, pokud jsou požadovány za procentem hodnoty entry_cache_timeout pro "
 "doménu."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Po jak dlouho umožnit přihlášení vůči mezipaměti do přihlášení při připojení "
 "(dny)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Kolik nezdařených pokusů o přihlášení je dovoleno bez připojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -313,86 +309,86 @@ msgstr ""
 "Jak dlouho (v minutách) odpírat přihlášení po dosažení "
 "offline_failed_login_attempts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "Jaký druh zpráv je zobrazován při ověřování uživatele"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Filtrovat PAM odpovědi poslané pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Kolik sekund si ponechávat informace o identitě v mezipaměti pro PAM "
 "požadavky"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "Kolik dnů před skončením platnosti hesla má být zobrazováno varování"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Seznam důvěryhodných identifikátorů uživatelů nebo uživatelských jmen"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "Seznam domén přístupných i nedůvěryhodným uživatelům."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "Zpráva vypsaná když platnost uživatelského účtu skončila."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "Zpráva vypisovaná když je účet uživatele uzamčen."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Umožnit ověřování založené na certifikátu/Smartcard."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "Popis umístění databáze certifikátů s PKCS#11 moduly."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Vyladit ověřování certifikátu pro PAM ověřování."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "Kolik sekund bude pam_sss čekat na dokončení p11_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr "Kterým PAM službám je umožněno kontaktovat aplikační domény"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Aplikace které je možné použít se SmartCard kartami"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Dodatečný časový limit po který čekat pokud je vyžádána karta"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr "PKCS#11 URI pro omezení výběru zařízení pro ověřování pomocí Smartcard"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "Kdy má PAM odpovídač vynutit initgroups požadavek"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "Seznam PAM služeb, kterým je dovoleno ověřovat pomocí GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "Zda hledat shodu ověřených UPN a cílového uživatele"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -401,28 +397,28 @@ msgstr ""
 "ověření), které je třeba vynutit pro přístup prostřednictvím PAM s GSSAPI "
 "ověřováním"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 #, fuzzy
 msgid "Allow passkey device authentication."
 msgstr "Umožnit ověřování založené na certifikátu/Smartcard."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "Kolik sekund bude pam_sss čekat na dokončení passkey_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Povolení ladění v knihovně libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "Zda vyhodnocovat na času založené atributy v pravidlech sudo"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "Pokud je zapnuto, SSSD přepne zpět na logiku řazení nižší vyhrává"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -430,11 +426,11 @@ msgstr ""
 "Nejvyšší umožněný počet pravidel, aktualizovaných naráz. Pokud je toto "
 "překročeno, je provedena úplná aktualizace."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "Zda v souboru known_hosts vytvářet otisk názvů strojů a adres"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -442,15 +438,15 @@ msgstr ""
 "Kolik sekund ponechávat stroj v souboru known_hosts poté, co byly vyžádány "
 "klíče stroje"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Popis umístění úložiště certifikátů důvěryhodných cert. autorit"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Umožnit vytváření ssh klíčů z certifikátů"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -458,25 +454,25 @@ msgstr ""
 "Použít následující pravidla pro hledání shod pro filtrování certifikátů pro "
 "vytváření ssh-klíče"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Seznam UID nebo uživatelských jmen, kterým je umožněn přístup k PAC "
 "odpovídači"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Po jak dlouho jsou PAC data považována za platná"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Ověřovat PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Seznam atributů uživatele, které InfoPipe bude moci zveřejnit"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -487,7 +483,7 @@ msgstr ""
 "skupiny, určení volbou uživatelů a skupiny jsou zaznamenání. all (vše) – "
 "zaznamenáni jsou všichni uživatelé."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -497,7 +493,7 @@ msgstr ""
 "Shodující se uživatelská jména jsou vrácena z NSS. T.j. po možném nahrazení "
 "mezer, změně velikosti písmen, atd."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -507,7 +503,7 @@ msgstr ""
 "relace. Odpovídající názvy skupin jsou vráceny z NSS. Tj. po možném "
 "nahrazení mezer, změn velikosti písmen, atd."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -515,7 +511,7 @@ msgstr ""
 "Čárkou oddělovaný seznam uživatelů, které vyjmout ze zaznamenávání, pouze "
 "pokud scope=all (rozsah=vše)"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -523,103 +519,103 @@ msgstr ""
 "Čárkou oddělovaný seznam skupin, dále členů, které vyjmout ze zaznamenávání, "
 "pouze pokud je scope=all (rozsah=vše). "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Poskytovatel identity"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Poskytovatel ověřování"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Poskytovatel řízení přístupu"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Poskytovatel změny hesel"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Poskytovatel SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Poskytovatel autofs"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Poskytovatel identity strojů"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "Poskytovatel SELinux"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Poskytovatel správy sezení"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Poskytovatel překladu (resolver)"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "Zda je doména použitelná pro operační systém nebo aplikace"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Povolit nebo zakázat doménu"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Nejnižší identif. uživatele"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Nejvyšší identif. uživatele"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Zapnout vyčíslování všech uživatelů/skupin"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 "Ukládat přihlašovací údaje do mezipaměti pro přihlašování se bez připojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Zobrazovat uživatele/skupiny v úplné podobě"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Nezahrnovat členy skupiny do hledání skupiny"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Délka časového limitu položky (v sekundách)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Omezit nebo upřednostnit konkrétní generaci adres při provádění DNS hledání"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Jak dlouho si ponechávat položky v mezipaměti po posledním úspěšném "
 "přihlášení (dny)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -627,19 +623,19 @@ msgstr ""
 "Jak dlouho se má SSSD pokoušet komunikovat s jedním DNS serverem, než "
 "vyzkouší další server (v milisekundách)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "Jak dlouho se pokoušet přeložit jeden DNS dotaz (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr "Jak dlouho čekat na odpovědi z DNS při překládání serverů (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Doménová část DNS dotazu pro objevování služby"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -648,106 +644,106 @@ msgstr ""
 "Určuje interval v sekundách, po kterém SSSD čeká, než se pokusí znovu "
 "připojit k primárnímu serveru po úspěšném připojení k záložnímu serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Přebít hodnotu GID z poskytovatele identit touto hodnotou"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "U uživatelských jmen rozlišovat velká a malá písmena"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 "Jak často mají být položky, kterým skončila platnost, na pozadí obnovovány"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 "Nejdelší umožněná odchylka periody při obnovování na pozadí položek, kterým "
 "skončila platnost"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Zda automaticky aktualizovat DNS položku klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "TTL které uplatnit na DNS položku klienta po její aktualizaci"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "Rozhraní, kterého IP adresu použít pro dynamickou aktualizaci DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Jak často pravidelně aktualizovat DNS záznam klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 #, fuzzy
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Jak často pravidelně aktualizovat DNS záznam klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 "Zda má poskytovatel výslovně aktualizovat také záznam pro zpětný překlad "
 "(PTR)"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Zda má nástroj nsupdate jako výchozí používat protokol TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr "Jaký druh ověřování by měl být použit při provádění aktualizace DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "Přepsat DNS server použité pro provedení DNS aktualizace"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Řídí vyčíslování důvěryhodných domén"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Jak často má být znovu načítán seznam dílčích domén"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "Maximální odchylka období při obnovení seznamu subdomén"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Seznam voleb které by měly být převzaté do dílčí domény"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Výchozí hodnota homedir dílčí domény"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Po jak dlouho mohou být přihlašovací údaje, uložené v mezipaměti, pro "
 "ověřování"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "Zda uživatelům automaticky vytvářet soukromé skupiny"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Zobrazit varování N dnů před skončením platnosti hesla."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr "Různé štítky uložené službou nastavování realmd pro tuto doménu."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -755,7 +751,7 @@ msgstr ""
 "Poskytovatel, který by měl obsluhovat získávání dílčích domén. Tato hodnota "
 "by měla být vždy stejná jako id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -763,7 +759,7 @@ msgstr ""
 "Kolik sekund ponechat ssh klíč hostitele po opětovném načtení. T.j. po jak "
 "dlouhou dobu ponechávat klíč hostitel v mezipaměti."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -774,101 +770,101 @@ msgstr ""
 "faktor ověřování (dlouhodobé heslo), od které je třeba ho uložit jako SHA512 "
 "otisk do mezipaměti."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Zásady místních metod ověřování "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA doména"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Adresa IPA serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adresa záložního IPA serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Název stroje klienta IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "Zda automaticky aktualizovat DNS položku klienta ve FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Základ hledání pro objekty, související s HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "Množství času mezi vyhledáváními HBAC pravidel vůči IPA serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 "Množství času (v sekundách) mezi vyhledáváními SELinux map vůči IPA serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr "Pokud je vypnuto, argument stroje daný PAM bude ignorován"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "Umístění automounter, které tento IPA klient používá"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "Základ hledání pro objekt obsahující informace o IPA doméně"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 "Základ hledání pro objekty obsahující informace o rozsazích identifikátorů"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Zapnout DNS sites – na umístění založené objevování služby"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Základ hledání pro zobrazení kontejnerů"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Objektová třída pro zobrazení kontejnerů"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Atribut obsahující název pohledu"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Objektová třída pro přepsání objektů"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Atribut obsahující odkaz na původní objekt"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Objektová třída pro uživatelské přepsání objektů"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Objektová třída pro objekty přepsání skupiny"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Základ hledání pro objekty související s desktopovým profilem"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -876,7 +872,7 @@ msgstr ""
 "Doba (v sekundách) mezi hledáními pravidel desktopového projektu vůči IPA "
 "serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -884,41 +880,41 @@ msgstr ""
 "Množství času (v minutách) mezi vyhledáními pravidel desktopových profilů "
 "vůči IPA serveru když poslední požadavek nenašel žádné pravidlo"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "Základ hledání pro SUBID rozsahy"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Která pravidla by měla být použita pro vyhodnocení řízení přístupu"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "LDAP atribut, který obsahuje FQDN hostitele."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "Třída objektu položky hostitele v LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "Použít daný řetězec jako základ hledání objektů hostitelů."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "LDAP atribut, který obsahuje veřejné části SSH klíčů hostitele."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "LDAP atribut, který obsahuje název NIS domény dané netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "LDAP atribut, který obsahuje jména členů síťové skupiny."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -926,7 +922,7 @@ msgstr ""
 "LDAP atribut, který je seznamem FQDN názvů hostitelů a jejich skupin, které "
 "jsou členy dané netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -934,11 +930,11 @@ msgstr ""
 "LDAP atribut, který je seznamem hostitelů a jejich skupin, kteří jsou "
 "přímými členy dané netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "LDAP atribut, který je seznamem členství v dané netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -946,20 +942,20 @@ msgstr ""
 "LDAP atribut, který je seznamem systémových uživatelů a skupin, které jsou "
 "přímými členy netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "LDAP atribut, který odpovídá názvu netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "Třída objektu položky dané netgroup v LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "LDAP atribut, který obsahuje UUID/GUID LDAP objektu pro netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -967,12 +963,12 @@ msgstr ""
 "LDAP atribut, který obsahuje zda je či není mapa uživatelů povolená k "
 "použití."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 "LDAP atribut, který obsahuje kategorii hostitelů, jako např. „all“ (všichni)."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -980,18 +976,18 @@ msgstr ""
 "LDAP atribut, který obsahuje veškeré hostitele / jejich skupiny, vůči "
 "kterému toto pravidlo porovnává."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "LDAP atribut, který obsahuje veškeré uživatele / skupiny, vůči kterým toto "
 "pravidlo porovnává."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "LDAP atribut, který obsahuje název SELinux mapy uživatelů."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -999,21 +995,21 @@ msgstr ""
 "LDAP atribut, který obsahuje DN HBAC pravidla, které je možné použít pro "
 "hledání shody namísto numberUser a memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "LDAP atribut, který obsahuje řetězec SELinux uživatele samotný."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 "LDAP atribut, který obsahuje kategorii uživatele, jako např. „all“ (všichni)."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 "LDAP atribut, který obsahuje neopakující se identifikátor mapy uživatelů."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1021,50 +1017,50 @@ msgstr ""
 "Tato volba označuje, že SSSD je spuštěné na IPA serveru a mělo by provádět "
 "hledání uživatelů a skupin z důvěryhodných domén jinak."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "Použít daný řetězec jako základ hledání pro důvěryhodné domény."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Doména Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Zapnout domény Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Adresa serveru s Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Adresa záložního serveru s Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Název stroje klienta Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "LDAP filtr pro zjišťování přístupových oprávnění"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Zda pro hledání používat globální katalog"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Režim fungování pro řízení přístupu založené na GPO objektech"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "Množství času mezi vyhledáními souborů GPO zásad vůči AD serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
@@ -1072,7 +1068,7 @@ msgstr ""
 "Názvy PAM služby, která mapuje na (Deny)InteractiveLogonRight nastavení "
 "zásady"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1080,287 +1076,287 @@ msgstr ""
 "Názvy PAM služby, která mapuje GPO (Deny)RemoteInteractiveLogonRight "
 "nastavení zásady"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "Názvy PAM služby, která mapuje GPO (Deny)NetworkLogonRight nastavení zásady"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "PNázvy PAM služby, která mapuje GPO (Deny)BatchLogonRight nastavení zásady"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "Názvy PAM služby, která mapuje GPO (Deny)ServiceLogonRight nastavení zásady"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 "Názvy PAM služby, pro které je přístup založený na GPO objektech vždy udělen"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 "Názvy PAM služby, pro které je přístup založený na GPO objektech vždy odepřen"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Výchozí přihlašovací oprávnění (nebo permit/deny), které použít pro názvy "
 "nenamapovaných PAM služeb"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "konkrétní místo kterou použít klientem"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Nejvyšší umožněné stáří (ve dnech) než by mělo být obnoveno heslo účtu stroje"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Volba pro vyladění úlohy obnovování účtu stroje"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr "Zda aktualizovat heslo účtu stroje v databázi Samba"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Použít LDAPS port pro požadavky na LDAP a globální katalog"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "Nefiltrovat doménové lokální skupiny z ostatních domény"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Adresa kerberos serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Adresa záložního kerberos serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos oblast"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Časový limit ověřování"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Zda vytvářet kdcinfo souborů"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Kam odkládat útržky nastavení krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Složka ve které ukládat mezipaměť přihlašovacích údajů"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Umístění mezipaměti přihlašovacích údajů uživatele"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 "Umístění uložených přihlašovacích údajů pro ověřování ověřovacích údajů"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Zapnout ověřování přihlašovacích údajů"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "Ukládat heslo pokud bez připojení pro pozdější ověření při připojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Obnovovatelná životnost TGT lístku"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Životnost TGT lístku"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Doba mezi dvěma kontrolami pro obnovu"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Zapíná FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Vybírá principal pro použití pro FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "K vyžádání FAST přihlašovacích údajů použít anonymní PKINIT"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Zapíná kanonizaci principalu"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Zapíná podnikové principaly"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Umožňuje používat oblasti (realm) dílčích domén pro ověřování se"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "Mapování z uživatelských jmen na názvy kerberos principal"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "Server na kterém je spuštěná služba pro změnu hesla, pokud to není KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, URI adresa LDAP serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, URI adresa LDAP serveru"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Výchozí základ rozlišeného názvu"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Typ schématu používaný na LDAP serveru, dle normy rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Režim použitý pro změnu hesla uživatele"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Výchozí spojovací rozlišený název"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Typ ověřovacího tokenu výchozího spojovacího rozlišeného názvu"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Ověřovací token výchozího spojovacího rozlišeného názvu"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Doba po kterou se pokoušet o připojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Doba po kterou se pokoušet o synchronní LDAP operace"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Doba mezi pokusy o opětovné připojení když bez připojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Pro názvy oblastí (realm) používat pouze velká písmena"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Soubor obsahující certifikáty cert. autorit"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Popis umístění složky s certifikáty cert. autority"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Soubor obsahující klientský certifikát"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Soubor který obsahuje klientský klíč"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Seznam možných šifrovacích algoritmů"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Vyžadovat ověření TSL certifikátem"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Určete sasl mechanizmus, který použít"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Zadejte identifikátor sasl ověřování které použít"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Zadejte oblast (realm) sasl ověřování kterou použít"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Zadejte minimální SSF pro LDAP sasl ověřování"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "Zadejte minimální SSF pro LDAP sasl ověřování"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Uložené přihlašovací údaje (keytab) služby kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Použít pro LDAP spojení kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Následovat LDAP odkazy"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Životnost TGT lístku pro LDAP spojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Jak rušit odkazování alternativních jmen"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Název služby pro hledání služby pomocí DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Počet záznamů které získávat v rámci jediného LDAP dotazu"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr "Počet členů který je třeba aby chyběli, aby bylo spuštěno plné deref"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Ignorovat nečitelné LDAP reference"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1368,7 +1364,7 @@ msgstr ""
 "Zda LDAP knihovna má provádět zpětný překlad pro kanonizaci názvu stroje při "
 "SASL spojení"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1376,30 +1372,36 @@ msgstr ""
 "Umožňuje držet místní uživatele coby členy LDAP skupiny pro servery, které "
 "používají schéma dle normy RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "atribut entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "atribut lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "Jak dlouho ponechat spojení s LDAP serverem před odpojením"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Vypnut řízení LDAP stránkování"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Vypnout získávání rozsahu Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "Použití rozšíření ppolicy"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Délka času po kterou čekat na požadavek hledání"
@@ -2002,34 +2004,34 @@ msgstr "Popis umístění souborových zdrojů passwd."
 msgid "Path of group file sources."
 msgstr "Popis umístění souborových zdrojů group."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "Operace vytvoření rejstříku se nezdařila: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr "'"
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 "Nepodporovaná hodnota '%s' konfigurační volba '%s'! Pouze 'root' nebo '"
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Přejít v proces služby (výchozí)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Spustit interaktivně (ne jako proces služby)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Vypsat číslo verze a skončit"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -2040,99 +2042,99 @@ msgstr ""
 "Neplatná možnost %s: %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 "Volbu -i|--interactive (interaktivní) není možné použít současně s -D|--"
 "daemon (proces služby)\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr "Nepodařilo se získat počáteční schopnosti\n"
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr "Nelze přečíst konfiguraci: '%s'\n"
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, fuzzy, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr "Nepodařilo se ukončit proces SSSD 'monitor': %s"
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Došla paměť\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Povolit diagnostické zapisování obsahu paměti"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Otevřený popisovač souboru pro záznam ladících informací"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "Uživatel pod kterým vytvořit FAST ccache"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Skupina pod kterou vytvořit FAST ccache"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "K vyžádání FAST chráněného tiketu použít anonymní PKINIT"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Kerberos oblast (realm) kterou použít"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Požadovaná životnost lístku"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Požadovaná obnovitelná životnosti lístku"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "FAST volby („never“, „try“, „demand“)"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "Určuje principal serveru které použít pro FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Požaduje kanonizaci názvu principalu"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Použít uživatelsky určenou verzi krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "Identifikátor Tevent řetězce použitého pro účely přihlašování se"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "Zkontrolovat PAC příznaky"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf se nezdařilo.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd se nezdařilo.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Doména poskytovatele informace (povinné)"
 
@@ -2166,145 +2168,145 @@ msgstr "Došlo k chybě, ale nedaří se najít popis."
 msgid "Unexpected error while looking for an error description"
 msgstr "Neočekávaná chyba při hledání popisu chyby"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Přístup odepřen. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Zpráva ze serveru: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
 # auto translated by TM merge from project: FreeIPA, version: ipa-4-5, DocId:
 # po/ipa
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Zadání hesla se neshodují"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Reset hesla správcem není podporován."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Přihlášeni přihlašovacími údaji z mezipaměti"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", platnost mezipaměti hesel skončí v: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Platnost vašeho hesla skončila. Zbývá vám %1$d přihlášení."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Platnost vašeho hesla skončí v %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Vaše heslo vypršelo."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Ověření odepřeno do: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Systém není dostupný, změna hesla není možná"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 "Po změně OTP hesla, je třeba se odhlásit/přihlásit aby byl získán lístek"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "Uzamčeno PIN"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Změna hesla se nezdařila. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "Ověřit na %1$s a stisknout ENTER."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "Ověřte se PIN kódem %1$s na %2$s a stiskněte Enter."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "(Znovu) vložte (jinou?) Smartcard kartu"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nové heslo: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Zopakování nového hesla: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Hlavní faktor: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Druhý faktor (volitelné): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Druhý faktor: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
 # auto translated by TM merge from project: anaconda, version: f25, DocId:
 # main
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Heslo: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Hlavní faktor (stávající heslo): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Stávající heslo: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Platnost hesla skončila. Změňte si ho."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Úroveň ladících informací, se kterou spustit"
 
@@ -2313,7 +2315,7 @@ msgstr "Úroveň ladících informací, se kterou spustit"
 msgid "The SSSD domain to use"
 msgstr "SSSD doména, kterou použít"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Chyba při nastavování místního a jazykového nastavení\n"
 
@@ -2375,85 +2377,89 @@ msgstr "sss_ssh_knownhostsproxy: připojit k hostiteli %s port %d: %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: Nedaří se přeložit název stroje %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Žádný z objektů v mezipaměti se neshoduje se zadaným hledáním\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "Nedaří se zneplatnit %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "Nedaří se zneplatnit %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Zneplatnit veškeré položky v mezipaměti"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Zneplatnit konkrétního uživatele"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Zneplatnit všechny uživatele"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Zneplatnit konkrétní skupinu"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Zneplatnit všechny skupiny"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Zneplatnit konkrétní síťovou skupinu"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Zneplatnit veškeré síťové skupiny"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Zneplatnit konkrétní službu"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Zneplatnit všechny služby"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Zneplatnit konkrétní autofs mapu"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Zneplatnit veškeré autofs mapy"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Zneplatnit konkrétního SSH hostitele"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Zneplatnit veškeré SSH hostitele"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Zneplatnit konkrétní sudo pravidlo"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Zneplatnit veškerá sudo pravidla v mezipaměti"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Zneplatnit pouze položky z konkrétní domény"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2461,11 +2467,11 @@ msgstr ""
 "Poskytnuty neočekávané argumenty, volby které zneplatňují jediný objekt "
 "přijímají pouze jediný zadaný argument.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Vyberte alespoň jeden objekt, který zneplatnit\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2474,7 +2480,7 @@ msgstr ""
 "Nedaří se otevřít doménu %1$s. Pokud je domény dílčí doménou (důvěryhodná "
 "doména), použijte úplný název namísto parametru --domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Nedaří se otevřít které domény jsou k dispozici\n"
 
@@ -2512,164 +2518,164 @@ msgstr "Nedaří se číst vstup od uživatele\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Neplatný vstup, zadejte buď „%s“ nebo „%s“.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Chyba při vykonávání externího příkazu\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Chyba při vykonávání externího příkazu „%s“\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "Příkaz „%s“ se nezdařil se stavem [%d].\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "Je třeba, aby bylo SSSD spuštěné. Spustit ho nyní?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "Je třeba, aby bylo SSSD zastavené. Zastavit ho nyní?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "Je třeba, aby bylo SSSD restartováno. Restartovat ho nyní?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "Stav SSSD:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Vypsat domény, které jsou k dispozici"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Zobrazit informace o doméně"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "Vypsat informace o uživateli a zkontrolovat ověřování"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Vytvořit výkaz o přístupech pro doménu"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Informace o obsahu v mezipaměti:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Informace o uživateli v mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Informace o skupině v mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Informace o netgroup v mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Nástroje pro místní data:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Zazálohovat místní data"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Obnovit místní data ze zálohy"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "Zazálohovat místní data a odebrat obsah z mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Zneplatnit obsah v mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Spravovat rejstříky mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Nástroje pro soubory se záznamem událostí:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Odebrat stávající soubory se záznamy událostí v SSSD"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "Zaarchivovat záznamy událostí v SSSD v tar balíčku"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 "Změnit nebo vypsat informaci o úrovni podrobností ladících informací z SSSD"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Zanalyzovat zaznamenaná data"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Nástroje pro soubory s nastaveními:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "Provést statickou analýzu nastavení SSSD"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Nástroje související s certifikáty:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Zobrazit informace o certifikátu"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Zobrazit uživatelé namapované na certifikát"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Zkontrolovat mapování a odpovídající pravidlo s certifikátem"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 #, fuzzy
 msgid "GPOs related tools:"
 msgstr "Nástroje související s passkey:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Informace o uživateli v mezipaměti"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Nástroje související s passkey:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 #, fuzzy
 msgid "Perform passkey registration"
 msgstr "Provést operace související s passkey"
@@ -2729,7 +2735,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Chyba: nedaří se získat objekt [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: nedaří se načíst hodnotu [%d]: %s\n"
@@ -2743,221 +2749,221 @@ msgstr "Zadejte jméno."
 msgid "Unable to parse name %s.\n"
 msgstr "Nedaří se zpracovat název %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Hledat podle SID identifikátoru"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Hledat podle identif. uživatele"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Okamžik skončení platnosti initgroups"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Hledat podle identif. skupiny"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 #, fuzzy
 msgid "Search by GPO guid"
 msgstr "Hledat podle identif. skupiny"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Nepodařilo se analyzovat příkazový řádek: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, fuzzy, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Nepodařilo se otevřít %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 #, fuzzy
 msgid "talloc failed\n"
 msgstr "malloc se nezdařilo.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 #, fuzzy
 msgid "Unable to get attribute list!\n"
 msgstr "Nedaří se získat seznam serverů\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "Nedaří se odebrat soubory mezipaměti\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 #, fuzzy
 msgid "Unable to get GPOs base DN\n"
 msgstr "Nedaří se získat seznam serverů\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Nelze prohledat sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, fuzzy, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "Nelze převést zprávu na atributy sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Nelze odstranit stažené soubory GPO: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, fuzzy, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Nepodařilo se otevřít %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "Nedaří se otevřít které domény jsou k dispozici\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, fuzzy, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Nepodařilo se otevřít %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Zobrazit ladicí informace"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "Zadejte certifikát v base64 kódování."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "Nedaří se připojit ke sběrnici systému!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - nenalezeni žádní namapovaní uživatelé -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "Mapovací pravidlo"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Mapovací pravidlo"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Nedaří se zpracovat argumenty.\n"
 
 # auto translated by TM merge from project: FreeIPA, version: ipa-4-5, DocId:
 # po/ipa
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Nedostatek paměti!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Nepodařilo se nastavit kontext mapování certifikátů.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "Nepodařilo se přidat mapování a pravidla pro hledání shody. Chyba byla [%d]"
 "[%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Nepodařilo se dekódovat řetězec base64.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Certifikát odpovídá pravidlu.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Certifikát neodpovídá pravidlu.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "Chyba při hledání shody s certifikátem [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "Nepodařilo se vytvořit filtr mapování [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2970,7 +2976,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2981,36 +2987,36 @@ msgstr ""
 "nastavení směřováno do „/moje/umisteni/sssd.conf“, pak je předpokládána "
 "složka s útržky nastavení v „/moje/umisteni/conf.d)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "soubor %1$s neexistuje.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 #, fuzzy
 msgid "There is no configuration.\n"
 msgstr "Nepodařilo se načíst nastavení z %s.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Chyba čtení '%s': %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Nepodařilo se spustit nástroje pro ověření správnosti"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Problémy identifikované nástroji pro ověření správnosti: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Zprávy vytvořené při slučování nastavení: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Použité soubory s útržky nastavení: %zu\n"
@@ -3032,100 +3038,100 @@ msgstr "Nedaří se exportovat přebití skupin\n"
 msgid "Unable to export group overrides\n"
 msgstr "Nedaří se exportovat přebití skupin\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Přepsat existující zálohu"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Nedaří se importovat přebití uživatelů\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Nedaří se importovat přebití skupin\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Pokud není, spustit proces služby sssd"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Po importu dat restartovat sssd"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Vytvořit prázdné soubory mezipaměti a importovat místní data"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Před odebráním mezipaměti zastavit sssd"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Při odebrání mezipaměti zastavit sssd"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Vytváření zálohy místních dat…\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr "Nedaří se vytvořit zálohu místních dat, nedaří se odebrat mezipaměť.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Odebírání souborů mezipaměti…\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Nedaří se odebrat soubory mezipaměti\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Obnovování místních dat…\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "Vytváří se rejstřík mezipaměti pro doménu %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "Maže se rejstřík mezipaměti pro doménu %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "Indexy pro doménu %1$s:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Atribut: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Cílit na konkrétní doménu"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "doména"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Atribut do rejstříku"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "atribut"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "Nezadána akce\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3134,181 +3140,181 @@ msgstr ""
 "Neznámá akce: %1$s\n"
 "Planými akcemi jsou „%2$s“, „%3$s“ a „%4$s“\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Atribut (-a) neposkytnut\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "Atribut %1$s není v rejstříku.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "Atribut %1$s už je v rejstříku.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Operace vytvoření rejstříku se nezdařila: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 "Nezapomínejte aktualizovat také rejstříky na vzdáleném poskytovateli.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr "Zobrazit seznam domén včetně typu hlavní nebo důvěryhodná doména"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "Online"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Offline"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Online stav: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "Tato doména nemá žádné aktivní servery.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Aktivní servery:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "nepřipojeno"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Neobjeveny žádné servery.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "Objeveno %s serverů:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Zatím žádné.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Zobrazit stav online"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Zobrazit informace o aktivním serveru"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Zobrazit seznam objevených serverů"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Zadejte název domény."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Nedaří se zjistit stav online\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Nedaří se získat seznam serverů\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD není spuštěné.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Neznámá doména\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Nedostupné zařízení\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Namísto zkrácení soubory se záznamem událostí smazat"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Mazání souborů se záznamem událostí…\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Nedaří se odebrat soubory se záznamem událostí\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Zkracování souborů…\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Nedaří se zkrátit soubory se záznamem událostí\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Archivují se soubory se záznamem událostí do %s…\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Nedaří se archivovat soubory se záznamem událostí\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "Cílit na službu SSSD"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "Cílit na službu NSS"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "Cílit na PAM službu"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "Cílit na SUDO službu"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "Cílit na AUTOFS službu"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "Cílit na SSH službu"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "Cílit na PAC službu"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "Cílit na IFP službu"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Zadejte stupeň podrobností ladících informací, který chcete nastavit"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "Chyba: chybí podpora pro identifikátor tevent řetězce, analýza záznamu "
@@ -3375,19 +3381,19 @@ msgstr ""
 " - shell: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "PAM akce [auth|acct|setc|chau|open|clos], výchozí: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "PAM služba, výchozí: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Zadejte uživatelské jméno."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3400,22 +3406,22 @@ msgstr ""
 "služba: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "Vyhledání uživatelského jména s [%s] se nezdařilo.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "InfoPipe vyhledání uživatele s [%s] se nezdařilo.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start se nezdařilo: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3423,12 +3429,12 @@ msgstr ""
 "zkoušení pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item se nezdařilo: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3437,7 +3443,7 @@ msgstr ""
 "pam_authenticate pro uživatele [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3445,7 +3451,7 @@ msgstr ""
 "zkoušení pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3454,7 +3460,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3462,7 +3468,7 @@ msgstr ""
 "zkoušení pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3471,7 +3477,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3479,7 +3485,7 @@ msgstr ""
 "zkoušení pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3488,7 +3494,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3496,7 +3502,7 @@ msgstr ""
 "zkoušení pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3505,7 +3511,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3513,7 +3519,7 @@ msgstr ""
 "zkoušení pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3522,26 +3528,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "neznámá akce\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "PAM prostředí:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - žádné prostředí -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Zadat nevýchozí soubor s nastaveními"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Informuje, že odpovídač byl aktivován soketem"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Počet pokusů o připojení k poskytovatelům dat"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Vypnout netlink rozhraní"
 
diff --git a/po/de.po b/po/de.po
index 87cb19074c2..a0e05cd1c7a 100644
--- a/po/de.po
+++ b/po/de.po
@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2022-07-01 09:40+0000\n"
 "Last-Translator: Joachim Philipp <joachim.philipp@gmail.com>\n"
 "Language-Team: German <https://translate.fedoraproject.org/projects/sssd/"
@@ -51,28 +51,24 @@ msgid "Command to start service"
 msgstr "Befehl zum Starten des Dienstes"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Anzahl der Verbindungsversuche zum Datenanbieter"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "Die Anzahl der Dateideskriptoren, die durch diesen Responder geöffnet werden "
 "dürfen"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Untätige Zeit vor der automatischen Verbindungstrennung eines Clients "
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Inaktivitätszeit bis zum automatischen Herunterfahren des Responders"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "Immer alle Zwischenspeicher abfragen vor Abfrage der Datenprovider"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -80,65 +76,65 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD-Dienste zum Starten"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD-Domains zum Starten"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Regulärer Ausdruck zum Verarbeiten von Benutzername und Domain"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 "Printf-kompatibles Format für die Darstellung voll ausgeschriebener Namen"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 "Verzeichnis im Dateisystem, in welchem SSSD den Kerberos Replay-Cache ablegt."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Domain, die zu Namen ohne Domain-Komponente hinzugefügt werden soll."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -151,83 +147,83 @@ msgstr ""
 "kann, werden wir darauf zurückgreifen, alle fünf Sekunden »resolv.conf« "
 "abzufragen."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Zeitspanne für den Aufzählungs-Zwischenspeicher (Sekunden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 "Zeitspanne für die Aktualisierung des Eintrags-Zwischenspeichers (Sekunden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Zeitspanne für den negativen Zwischenspeicher (Sekunden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Benutzer, die SSSD ausdrücklich ignorieren soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Gruppen, die SSSD ausdrücklich ignorieren soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Anzeige von gefilterten Benutzern in Gruppen"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 "Der Wert des Passwort-Feldes, das der NSS-Dienstanbieter zurückgeben sollte"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "homedir-Wert des Identitäts-Anbieters wird durch diesen Wert außer Kraft "
 "gesetzt"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Leerer homedir-Wert des Identitäts-Anbieters wird durch diesen Wert ersetzt"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 "Shell-Wert des Identitäts-Anbieters wird durch diesen Wert außer Kraft "
 "gesetzt"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Liste der Shells, mit denen sich der Benutzer anmelden darf"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "Die Liste der Shells, die abgewiesen und durch eine Ausweich-Shell ersetzt "
 "werden"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -235,39 +231,39 @@ msgstr ""
 "Falls eine Shell im zentralen Verzeichnis zugelassen, aber nicht verfügbar "
 "ist, wird auf diese ausgewichen"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Zu verwendende Shell, wenn der Anbieter keine auflistet"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Gültigkeitsdauer der speichereigenen Zwischenspeicher-Datensätze"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -275,24 +271,24 @@ msgstr ""
 "gibt die Zeit in Sekunden an, während der die Liste der Subdomains als "
 "gültig erachtet wird."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Gibt die Anzahl der Tage an, für die zwischengespeicherte Anmeldungen "
 "zwischen Online-Anmeldungen zulässig sind"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Anzahl der zulässigen fehlgeschlagenen Anmeldungen im Offline-Modus"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -300,130 +296,130 @@ msgstr ""
 "Zeitspanne in Minuten, nach der die Anmeldung verweigert wird, wenn "
 "offline_failed_login_attempts erreicht wurde"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 "Gibt die Art der Meldungen an, die dem Benutzer während der "
 "Authentifizierung angezeigt werden"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Anzahl der Sekunden, die zwischengespeicherte PAM-Anfragen aufbewahrt werden "
 "sollen"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 "Gibt die Anzahl der Tage vor dem Ablauf des Passworts an, bis eine Warnung "
 "angezeigt wird"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "TLS-Zertifikatüberprüfung erforderlich machen"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 "Gibt an, ob zeitbasierte Attribute in Sudo-Regeln berechnet werden sollen"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "Gibt an, ob Prüfsummen von Hostnamen und Adressen in der Datei known_hosts "
 "gespeichert werden"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -431,311 +427,311 @@ msgstr ""
 "Anzahl der Sekunden, die ein Rechner in der Datei known_host behalten werden "
 "soll, nachdem dessen Schlüssel abgefragt wurden"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Liste von Benutzer-IDs oder Benutzernamen für den Zugriff auf den PAC-"
 "Responder"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Liste der Benutzerattribute, die InfoPipe veröffentlichen darf"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Identitäts-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Authentifizierungs-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Zugriffskontroll-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Passwortänderungs-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Rechner-Identitäts-Anbieter"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "Validierung der Anmeldedaten aktivieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Minimale Benutzer‐ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Maximale Benutzer‐ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Auflistung aller Benutzer/Gruppen aktivieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Zwischengespeicherte Anmeldedaten für Offline-Anmeldung"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Benutzer/Gruppen in voll ausgeschriebener Form anzeigen"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Gruppenmitglieder in Gruppen-Suchanfragen nicht einschließen"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Zeitspanne für den Eintrags-Zwischenspeicher (Sekunden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Eine spezifische Adressfamilie beim Ausführen von DNS-Suchanfragen "
 "beschränken oder bevorzugen"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Gibt die Anzahl der Tage an, wie lange zwischengespeicherte Einträge nach "
 "der letzten Anmeldung aufbewahrt werden"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Gibt die Anzahl Sekunden an, wie lange beim Auflösen von Servernamen auf "
 "Antworten vom DNS-Dienst gewartet werden soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Der Domain-Teil der DNS-Abfrage zur Dienstsuche"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 "Den Gruppen-ID-Wert des Identitäts-Anbieters mit diesem Wert überschreiben"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Groß-/Kleinschreibung in Benutzernamen berücksichtigen"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Anzahl der Auffrischung abgelaufener Einträge im Hintergrund"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Automatische Aktualisierung des DNS-Eintrags des Clients"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 "Die auf den DNS-Eintrag des Clients anzuwendende TTL, nachdem dieser "
 "aktualisiert wurde"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "Schnittstelle, deren IP für dynamische DNS-Aktualisierungen verwendet werden "
 "soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Gibt an, wie oft der DNS-Eintrag des Clients aktualisiert werden soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 #, fuzzy
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Gibt an, wie oft der DNS-Eintrag des Clients aktualisiert werden soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 "Gibt an, ob der Anbieter den PTR-Datensatz ebenfalls explizit aktualisieren "
 "soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Gibt an, ob das nsupdate-Dienstprogramm per Vorgabe TCP verwenden soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Gibt an, welche Art der Authentifizierung bei der DNS-Aktualisierung "
 "verwendet werden soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Aufzählung vertrauenswürdiger Domains steuern"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Anzahl der Auffrischung der Subdomain-Liste"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "zeigt N Tage vor Ablauf des Passworts eine Warnung an."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "verschiedene vom Konfigurationsdienst »realmd« für diese Domain gespeicherte "
 "Kennzeichnungen."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -746,42 +742,42 @@ msgstr ""
 "(langlebiges Passwort) mindestens sein muss um als SHA512 Hash-Wert im Cache "
 "gespeichert zu werden."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA-Domain"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA-Serveradresse"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adresse des Ersatz-IPA-Servers"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA-Client-Rechnername"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "Gibt an, ob der DNS-Eintrag des Clients in FreeIPA automatisch aktualisiert "
 "werden soll"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Suchbasis für HBAC-bezogene Objekte"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "Die Zeitspanne zwischen Suchanfragen der HBAC-Regeln an den IPA-Server"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
@@ -789,524 +785,524 @@ msgstr ""
 "Die Zeitspanne in Sekunden zwischen Suchanfragen der SELinux-Zuweisung an "
 "den IPA-Server"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Falls auf »false« gesetzt, wird das von PAM angegebene Host-Argument "
 "ignoriert"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "Der Automounter-Ort, den dieser IPA-Client verwendet"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 "Suchbasis für Objekte, die Informationen über eine IPA-Domain enthalten"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "Suchbasis für Objekte, die Informationen über ID-Bereiche enthalten"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "DNS-Sites aktivieren – standortbasierte Dienstsuche"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 #, fuzzy
 msgid "Search base for SUBID ranges"
 msgstr "Suchbasis für HBAC-bezogene Objekte"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Regeln für die Ermittlung der Zugriffskontrolle"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "das LDAP-Attribut, das die Namen der Netzgruppenmitglieder enthält"
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "das LDAP-Attribut, das dem Netzgruppennamen entspricht"
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "die Objektklasse eines Netzgruppeneintrags in LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active-Directory-Domain"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Adresse des Active-Directory-Servers"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Adresse des Ersatz-Active-Directory-Servers"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Hostname des Active-Directory-Clients"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "LDAP-Filter zum Bestimmen der Zugriffsprivilegien"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Verwendung des globalen Katalogs für Suchvorgänge"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Operationsmodus für GPO-basierte Zuhgriffskontrolle"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos-Serveradresse"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Adresse des Ersatz-Kerberos-Servers"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos-Realm"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Zeitüberschreitung bei Authentifizierung"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Gibt an, ob kdcinfo-Dateien angelegt werden"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Verzeichnis zum Speichern der Anmeldedaten"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Ort des Zwischenspeichers für die Anmeldedaten des Benutzers"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Ort der Schlüsseltabelle zum Überprüfen von Anmeldedaten"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Validierung der Anmeldedaten aktivieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "Passwort im Offline-Modus für spätere Online-Anmeldung speichern"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Erneuerung der Lebensdauer des TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Lebensdauer des TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Zeitspanne zwischen zwei Prüfungen, ob Erneuerung nötig ist"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Aktiviert FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Wählt den für FAST zu verwendenden Principal aus"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Aktiviert Kanonisierung des Principals"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Enterprise-Principals aktivieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Server, auf dem der Dienst zum Ändern des Passworts läuft, falls nicht KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, die URI des LDAP-Servers"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, die URI des LDAP-Servers"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Vorgegebene Basis-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Der vom LDAP-Server verwendete Schema-Typ gemäß RFC2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Vorgegebene Bind-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Typ des Authentifizierungs-Tokens der vorgegebenen Bind-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Authentifizierungs-Token für die vorgegebene Bind-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Zeitspanne für einen Verbindungsversuch"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Zeitspanne für Versuche zur Ausführung synchroner LDAP-Vorgänge"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 "Zeitspanne zwischen Versuchen zum erneuten Verbindungsaufbau im Offline-Modus"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Nur Großschreibung für Realm-Namen verwenden"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Datei, die CA-Zertifikate enthält"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Pfad zum CA-Zertifikatverzeichnis"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Datei, die das Client-Zertifikat enthält"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Datei, die den Client-Schlüssel enthält"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Liste der möglichen Verschlüsselungs-Suites"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "TLS-Zertifikatüberprüfung erforderlich machen"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Zu verwendenden sasl-Mechanismus angeben"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Zu verwendende ID für sasl-Authentifizierung angeben"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Zu verwendenden Realm für sasl-Authentifizierung angeben"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Gibt den minimalen SSF für die SASL-Authentifizierung über LDAP an"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Schlüsseltabelle des Kerberos-Dienstes"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Kerberos-Authentifizierung für LDAP-Verbindung verwenden"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "LDAP-Verweisen folgen"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Lebensdauer von TGT für LDAP-Verbindung"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Dereferenzierung von Aliasen"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Dienstname für DNS-Service-Suchanfragen"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Anzahl der in einer einzelnen LDAP-Abfrage zu holenden Datensätze"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "Anzahl der Elemente, die fehlen müssen, um eine vollständige "
 "Dereferenzierung auszulösen"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1314,7 +1310,7 @@ msgstr ""
 "Gibt an, ob die LDAP-Bibliothek eine Rückwärtssuche ausführen soll, um den "
 "Rechnernamen während einer SASL-Bindung zu kanonisieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1322,32 +1318,38 @@ msgstr ""
 "ermöglich, lokale Anwender als Mitglieder einer LDAP-Gruppe für Server "
 "beizubehalten, die das Schema RFC2307 benutzen."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN-Attribut"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN-Attribut"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "Zeitspanne zum Halten einer Verbindung zum LDAP-Server, bis diese "
 "unterbrochen wird"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "LDAP-Paging-Steuerung deaktivieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Bereichsermittlung für Active Directory deaktivieren"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Zeitspanne zum Warten auf eine Suchanfrage"
@@ -1952,33 +1954,33 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "Der nach dem Löschen auszuführende Befehl ist fehlgeschlagen: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Zum Hintergrunddienst werden (Vorgabe)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Interaktiv ausführen (nicht als Hintergrunddienst)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Versionsnummer ausgeben und das Programm beenden"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -1986,97 +1988,97 @@ msgid ""
 "\n"
 msgstr "Der nach dem Löschen auszuführende Befehl ist fehlgeschlagen: %1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Nicht genügend Speicher\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Offener Dateideskriptor für die Debug-Protokolle"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domain des Informationsanbieters (obligatorisch)"
 
@@ -2111,66 +2113,66 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr "Unerwarteter Fehler beim Suchen nach einer Fehlerbeschreibung"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Server-Meldung: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Passwörter stimmen nicht überein"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Das Zurücksetzen des Passworts durch Root wird nicht unterstützt."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Authentifiziert mit zwischengespeicherten Anmeldedaten"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", Ihr zwischengespeichertes Passwort läuft ab am: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 "Ihr Passwort ist abgelaufen. Ihnen verbleiben nur noch %1$d Anmeldungen."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Ihr Passwort wird in %1$d %2$s ablaufen."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "Ihr Passwort wird in %1$d %2$s ablaufen."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Authentifizierung wird verweigert bis: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "System ist offline, Änderung des Passworts ist nicht möglich"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2178,76 +2180,76 @@ msgstr ""
 "Nach dem Ändern des OTP-Passworts müssen Sie sich ab- und wieder anmelden, "
 "um ein Ticket erhalten zu können"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Änderung des Passworts fehlgeschlagen. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Neues Passwort: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Neues Passwort wiederholen: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Erster Faktor (Passwort): "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Zweiter Faktor (optional): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Zweiter Faktor (OTP Token): "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Passwort: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Erster Faktor (aktuelles Passwort): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Aktuelles Passwort: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Passwort ist abgelaufen. Ändern Sie Ihr Passwort jetzt."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Stufe, mit der die Fehlerdiagnose ausgeführt werden soll"
 
@@ -2256,7 +2258,7 @@ msgstr "Stufe, mit der die Fehlerdiagnose ausgeführt werden soll"
 msgid "The SSSD domain to use"
 msgstr "Die zu verwendende SSSD-Domain"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Fehler beim Setzen der Locale-Einstellung\n"
 
@@ -2318,96 +2320,100 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 "Kein Objekt im Zwischenspeicher entspricht der angegebenen Suchanfrage\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Bestimmten Benutzer annullieren"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Alle Benutzer annullieren"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Bestimmte Gruppe annullieren"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Alle Gruppen annullieren"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Bestimmte Netzgruppe annullieren"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Alle Netzgruppen annullieren"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Bestimmten Dienst annullieren"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Alle Dienste annullieren"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Bestimmte autofs-Zuweisung annullieren"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Alle autofs-Zuweisungen annullieren"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Nur Einträge einer bestimmten Domain annullieren"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Bitte wählen Sie mindestens ein Objekt für die Annullierung\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2417,7 +2423,7 @@ msgstr ""
 "(trusted domain) handelt, verwenden Sie den voll ausgeschriebenen Namen "
 "anstelle des Parameters --domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Verfügbare Domains konnten nicht geöffnet werden\n"
 
@@ -2451,166 +2457,166 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 #, fuzzy
 msgid "List available domains"
 msgstr "Verfügbare Domains konnten nicht geöffnet werden\n"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 #, fuzzy
 msgid "Print information about domain"
 msgstr "Aufzählung vertrauenswürdiger Domains steuern"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Info zum Benutzer nicht gefunden\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 #, fuzzy
 msgid "Invalidate cached objects"
 msgstr "Alle Benutzer annullieren"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Info zum Benutzer nicht gefunden\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2665,7 +2671,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2679,212 +2685,212 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "Verfügbare Domains konnten nicht geöffnet werden\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2893,42 +2899,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2950,285 +2956,285 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA-Domain"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "UID-Attribut"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Authentifizierungs-Anbieter"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, fuzzy, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Der nach dem Löschen auszuführende Befehl ist fehlgeschlagen: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "SSSD wird nicht durch Root ausgeführt."
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 #, fuzzy
 msgid "Target the PAM service"
 msgstr "Attribut, welches die autorisierten PAM-Dienste auflistet"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3291,19 +3297,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3312,124 +3318,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Angabe einer nicht standardmäßigen Konfigurationsdatei"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Anzahl der Verbindungsversuche zum Datenanbieter"
+
 #~ msgid "Privileged socket has wrong ownership or permissions."
 #~ msgstr "Privilegierter Socket hat falsche Eigentums- oder Zugriffsrechte."
 
diff --git a/po/es.po b/po/es.po
index 3e9bb51436a..169e73258d1 100644
--- a/po/es.po
+++ b/po/es.po
@@ -18,7 +18,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-07-01 16:36+0000\n"
 "Last-Translator: Emilio Herrera <ehespinosa57@gmail.com>\n"
 "Language-Team: Spanish <https://translate.fedoraproject.org/projects/sssd/"
@@ -57,31 +57,26 @@ msgid "Command to start service"
 msgstr "Comando para iniciar el servicio"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-"Número de veces que debe intentar la conexión con los Proveedores de Datos"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "El número de descriptores de archivos que pueden ser abiertos por este "
 "contestador"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Tiempo de inactividad antes de la desconexión automática de un cliente"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Tiempo de inactividad antes del apagado automático de un contestador"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 "Preguntar siempre a todos los caches antes de preguntar a los Proveedores de "
 "Datos"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -93,26 +88,26 @@ msgstr ""
 "estado desconectado. Este valor es en segundos y se calcula mediante lo "
 "siguiente: offline_timeout + random_offset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Servicios SSSD a iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Dominios SSSD a iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 "Expresión regular para analizar sintácticamente el nombre de usuario y "
 "dominio"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 "Formato compatible con printf para mostrar nombres completamente calificados"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -120,37 +115,37 @@ msgstr ""
 "Directorio en el sistema de archivos donde SSSD debería guardar fichero de "
 "reproducción de cache de Kerberos."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Dominio para añadir a los nombres sin componente de dominio."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "El usuario a quitar privilegios"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Ajustar la verificación del cetificado"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Todos los espacios en los nombres de usuario o grupo serán reemplazados por "
 "este caracter"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "Ajustar sssd para aceptar o ignorar los cambios de estados de netlink"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Habilitar o deshabilitar el dominio implícito de archivos"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Un orden especifico de los dominios a buscar"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -158,7 +153,7 @@ msgstr ""
 "Controla si SSSD monitorizaría el estado de resolv.conf para identificar "
 "cuando necesita actualizar su interfaz de resolución DNS interno."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -170,84 +165,84 @@ msgstr ""
 "ello la herramienta inotify, quien consultará a resolv.conf cada cinco "
 "segundos en caso que inotify no pueda ser utilizado."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 "Ejecutar el contestador PAC automáticamente para los proveedores AD e IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 "Habilita o deshabilita los volcados del núcleo para todos los procesos SSSD."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Ajustar la verificación del certificado"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Tiempo máximo (segundos) del caché de enumeración"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 "Tiempo máximo (segundos) de la entrada de caché a actualizar en segundo plano"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Tiempo máximo negativo del cache (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 "Longitud de tiempo de espera para el cache negativo de archivos (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Usuarios que deben ser explícitamente ignorados por SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Grupos que deben ser explícitamente ignorados por SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Deben aparecer los usuarios filtrados en los grupos"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "El valor del campo contraseña que el proveedor NSS debe devolver"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Sustituye valores del directorio personal del proveedor de la identidad con "
 "este valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Sustituir el valor vacío de homedir de la identidad del proveedor con este "
 "valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 "Sustituir el valor de shell de la identidad del proveedor por este valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Lista de los usuarios de consola habilitados para registrarse"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "Lista de consolas que serán vetadas, y reemplazadas por la consola de reserva"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -255,15 +250,15 @@ msgstr ""
 "Si una consola almacenada en el directorio central es permitida pero no se "
 "encuentra disponible, utilice esta de reserva"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Shell a usar si el proveedor no lista uno"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Cuanto serán validos en la memoria los cache los registros"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -271,7 +266,7 @@ msgstr ""
 "Tamaño (en megabytes) de la tabla de datos colocada dentro de la memoria "
 "caché interna para las peticiones de contraseña"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -279,7 +274,7 @@ msgstr ""
 "Tamaño (en megabytes) de la tabla de datos colocada dentro de la memoria "
 "caché interna para las peticiones de grupo"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -287,7 +282,7 @@ msgstr ""
 "Tamaño (en megabytes) de la tabla de datos colocada en la memoria caché "
 "interna para las peticiones de initgroups"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -295,7 +290,7 @@ msgstr ""
 "El valor de esta opción será usado en la expansión de la opción "
 "override_homedir si la plantilla contiene el formato de cadena %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -303,7 +298,7 @@ msgstr ""
 "Especifica el tiempo en segundos por los cuales la lista de subdominios será "
 "considerada válida."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -313,17 +308,17 @@ msgstr ""
 "entradas en segundo plano si hay peticiones más allá de un porcentanje del "
 "valor de entry_cache_timeout para el dominio."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Por cuánto tiempo permitir ingresos cacheados entre ingresos en línea (días)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 "Cuantos intentos de ingreso fallidos se permiten cuando está desconectado"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -331,89 +326,89 @@ msgstr ""
 "Cuántos minutos se denegará el ingreso después de que se alcance el máximo "
 "de ingresos fallidos offline_failed_login_attempts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "Que clase de mensajes se muestran al usuario durante la autenticación"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Filtrar las respuestas PAM enviadas al pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Cuanto segundos se mantendrá la información de identidad almacenada para "
 "solicitudes de PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "Cuanto días se debe mostrar un aviso de expiración de contraseña"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Lista de uids o nombres de usuario de confianza"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "Lista de dominios accesibles aún para usuarios los que no se confíe."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "Mensaje impreso cuando una cuenta de usuario expira."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "Mensaje impreso cuando una cuenta de usuario es bloqueada."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Permitir el certificado basado/en autenticación Smartcard."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "Ruta a la base de datos de certificados con módulos PKCS#11."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Ajustar la verificación de certificado para autenticación PAM."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "Cuantos segundos esperará pam_sss a que termine p11_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 "Que servicios PAM tienen permitido contactar con dominios de aplicación"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Servicios permitidos usando smartcards"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Tiempo de espera adicional a esperar por una tarjeta si se pide"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "PKCS#11 URI para restringir la selección de dispositivos para autenticación "
 "Smartcard"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "Cuando deberá el respondedor PAM forzar una petición initgroups"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "Lista de servicios PAM que tienen permitido autenticar con GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "Ya sea para hacer coincidir el UPN autenticado con el usuario objetivo"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -421,27 +416,27 @@ msgstr ""
 "La lista de pares <PAM service>:<authentication indicator> que se debe hacer "
 "cumplir para el acceso PAM con autenticación GSSAPI"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Permitir la autentificación del dispositivo con clave de acceso."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "Cuantos segundos esperará pam_sss a que termine passkey_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Habilitar la depuración en la librería libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "Ya sea para evaluar los atributos basados en el tiempo en reglas sudo"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "Si cierto, SSSD volverá a la lógica de ordenación de triunfos menores"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -449,13 +444,13 @@ msgstr ""
 "Número máximo de reglas que se pueden refrescar de una vez. Si esto se "
 "excede, se llevará a cabo un refresco total."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "Si se deben picar los nombres de host y las direcciones en el archivo known-"
 "hosts"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -463,15 +458,15 @@ msgstr ""
 "Cuantos segundos mantener un host en el archivos known_host después de que "
 "se haya pedido su clave de host"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Ruta al almacenamiento de los certificados CA de confianza"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Permite generar claves ssh desde certificados"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -479,25 +474,25 @@ msgstr ""
 "Usar las siguientes reglas de coincidencia para filtrar los certificados "
 "para la generación de clave ssh"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Lista de UIDs o nombres de usuario que tienen permitido acceder al "
 "contestador PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Longitud de datos PAC considerados válidos"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Validar el PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Lista de atributos de usuario que InforPipe tiene permitido publicar"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -508,7 +503,7 @@ msgstr ""
 "por las opciones usuarios y grupos se registran. all - Se registran todos "
 "los usuarios."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -519,7 +514,7 @@ msgstr ""
 "NSS. I.e. después de las posibles sustituciones de espacios, cambios de "
 "mayúsculas/minúsculas, etc."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -530,7 +525,7 @@ msgstr ""
 "I.e. después de los posibles cambios de espacio, cambios de mayúsculas/"
 "minúsculas, etc."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -538,7 +533,7 @@ msgstr ""
 "Una lista separada por comas de usuarios a ser excluidos de la grabación, "
 "sólo cuando scope=all"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -546,101 +541,101 @@ msgstr ""
 "Una lista separada de grupos, cuyos miembros serían excluidos de la "
 "grabación, sólo cuando scope=all. "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Proveedor de identidad"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Proveedor de Autenticación"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Proveedor de control de acceso"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Proveedor de cambio de contraseña"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Proveedor de SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Proveedor de Autofs"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Suministrador de identidad de host"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "Proveedor SELinux"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Proveedor de gestión de sesión"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Proveedor de resolución"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "Si el dominio es utilizable por el SO o por las aplicaciones"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Habilitar o deshabilitar el dominio"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "ID mínimo de usuario"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "ID máximo de usuario"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Habilitar la enumeración de todos los usuarios/grupos"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Hacer caché de las credenciales para ingresos fuera de línea"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Mostrar los usuarios/grupos en un formato completamente calificado"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "No incluye a los miembros del grupo en las búsquedas de grupo"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Tiempo máximo de una entrada del caché (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Restringir o preferir una familia de direcciones específica, cuando se "
 "realicen búsquedas DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr "Por cuánto tiempo permitir ingresos cacheados luego del último (días)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -648,23 +643,23 @@ msgstr ""
 "Cuanto debería SSSD hablar con un único servidor DNS antes de intentar el "
 "siguiente servidor (milisegundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 "Cuanto debería mantenerse intentando resolver una única petición DNS "
 "(segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Cantidad de tiempo (en segundos) a esperar respuestas desde DNS cuando se "
 "estén resolviendo servidores"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "La sección del dominio de la consulta para descubrir servicios DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -674,113 +669,113 @@ msgstr ""
 "volver a conector con el servidor principal después de una conexión con "
 "éxito al servidor de respaldo"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Sustituye valor GID del proveedor de la identidad con este valor"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Trate al nombre de usuario con mayúsculas y minúsculas"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 "Frecuencia con la que deberían expirar las entradas refrescada en segundo "
 "plano"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 "Desviación máxima del período al actualizar entradas caducadas en segundo "
 "plano"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Que actualice automáticamente las entradas del cliente DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "El TTL a aplicar a la entrada del cliente DNS después de actualizarla"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "La interfaz cuya IP debería ser utilizada para actualizaciones DNS "
 "automáticas"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 "Frecuencia con la que actualizar periódicamente la entrada del cliente DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Desviación máxima del período al actualizar la entrada DNS del cliente"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 "Si el proveedor debería explícitamente actualizar el registro PTR también"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Si la utilidad nsupdate debería utilizar por defecto TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Clase de autenticación que debería ser usada para llevar a cabo una "
 "actualización DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 "Borrar el servidor DNS utilizado para llevar a cabo una actualización DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Control de enumeración de los dominios de confianza"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Frecuencia con la que la lista de subdominios es refrescada"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 "Desviación máxima del período cuando se refresca la lista de subdominios"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Lista de las opciones que serían heredadas a un subdominio"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Valor homedir del subdominio por defecto"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Cuanto serán usadas las credenciales en cache para la autenticación en cache"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "Ya sea para crear grupos privados para usuarios"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Mostrar una advertencia N días antes que la contraseña caduque."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Diversas banderas almacenadas por el servicio de configuración realmd para "
 "este dominio."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -788,7 +783,7 @@ msgstr ""
 "El proveedor que debería manejar la búsqueda de subdominios. Este valor "
 "debería ser siempre el mismo de id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -796,7 +791,7 @@ msgstr ""
 "Cuantos segundos mantener una clave ssh de host después de refrescar. IE "
 "cuanto guardar en caché la clave de host."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -807,42 +802,42 @@ msgstr ""
 "autenticación (contraseña de largo plazo) que debe ser guardado como hash "
 "SHA512 en el caché."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Métodos de política de autenticación local "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Dominio IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Dirección del servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Dirección del servidor de respaldo IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Nombre de equipo del cliente IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "Si actualizar o no en forma automática la entrada DNS del cliente en FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Búsqueda base para objetos HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 "Cantidad de tiempo entre búsquedas de reglas HBAC contra el servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
@@ -850,65 +845,65 @@ msgstr ""
 "La cantidad de tiempo en segundos entre búsquedas de los mapas SELinux "
 "contra el servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Si se lo define en 'false', será ignorado el argumento de equipo ofrecido "
 "por PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "La ubicación de montaje automático que este cliente de IPA está usando"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 "Buscar base para el objeto que contiene información sobre el dominio IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 "Buscar base para los objetos que contienen información sobre los rangos ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 "Habilita la localización de sitios DNS en base al servicio de descubrimiento"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Buscar base para la visualización de contenedores"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Objectclass para visualizar contenedores"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Atributo con el nombre de la vista"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Objectclass para anular objetos"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Atributo con la referencia al objeto original"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Objectclass para anular objetos de usuario"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Objectclass para anular objetos de grupo"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Base de búsqueda para objetos relacionados con Desktop Profile"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -916,7 +911,7 @@ msgstr ""
 "La cantidad de tiempo en segundos entre las búsquedas de las reglas Desktop "
 "Profile contra el servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -925,43 +920,43 @@ msgstr ""
 "Profiles contra el servidor IPA cuando la última petición no ha encontrado "
 "ninguna regla"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "Buscar base para rangos SUBID"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Las reglas que deberían ser utilizadas para evaluar control de acceso"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "El atributo LDAP que contiene el FQDN del host."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "La clase de objeto de una entrada de host en LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "Usa la cadena dada como base de búsqueda para objetos host."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "El atributo LDAP que contiene las claves públicas SSH del host."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 "El atributo LDAP que contiene el nombre de dominio NIS del grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 "El atributo LDAP que contiene los nombres de los miembros de grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -969,7 +964,7 @@ msgstr ""
 "El atributo LDAP que lista los FQDNs de hosts y grupos de host que son "
 "miembros del grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -977,11 +972,11 @@ msgstr ""
 "El atributo LDAP que lista hosts y grupos de host que son miembros directos "
 "del grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "El atributo LDAP que lista la membresía del grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -989,21 +984,21 @@ msgstr ""
 "El atributo LDAP que lista los usuarios y grupos del sistema que son "
 "miembros directos del grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "El atributo LDAP que corresponde al nombre de grupo de red."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "La clase objeto de una entrada de grupo de red en LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 "El atributo LDAP que contiene el UUID/GUID de un objeto de grupo de red LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -1011,11 +1006,11 @@ msgstr ""
 "El atributo LDAP que contiene si o no el mapa de usuario está habilitado "
 "para su uso."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "El atributo LDAP que contiene la categoría de host como 'all'."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -1023,18 +1018,18 @@ msgstr ""
 "El atributo LDAP que contiene todos los hosts / grupos de host que deben "
 "coincidir con esta regla."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "El atributo LDAP que contiene todos los usuarios / grupos que deben "
 "coincidir con esta regla."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "El atributo LDAP que contiene el nombre del mapa de usuario SELinux."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -1042,19 +1037,19 @@ msgstr ""
 "El atributo LDAP que contiene el DN de la regla HBAC que se debe usar para "
 "coincidir en lugar de memberUser y memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "El atributo LDAP que contiene la cadena de usuario SELinux misma."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "El atributo LDAP que contiene la categoría de usuario como 'all'."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "El atributo LDAP que contiene la ID única del mapa de usuario."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1064,44 +1059,44 @@ msgstr ""
 "server and should perform lookups of users and groups from trusted domains "
 "diferentemente."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "Usa la cadena dada como base de búsqueda de dominios de confianza."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Dominio Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Habilitar dominio Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Dirección del servidor Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Dirección del servidor de respaldo Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Nombre de host del cliente de Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Filtro LDAP para determinar privilegios de acceso"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Si se usa Global Catalog para búsquedas"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Modo de operación para control de acceso basado en GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
@@ -1109,7 +1104,7 @@ msgstr ""
 "La cantidad de tiempo entre búsquedas de los ficheros de política GPO contra "
 "el servidor AD"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
@@ -1117,7 +1112,7 @@ msgstr ""
 "Servicio de nombres PAM que mapea a los ajustes de política GPO "
 "(Deny)InteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1125,299 +1120,299 @@ msgstr ""
 "Servicio de nombres PAM que mapea a los ajustes de política GPO "
 "(Deny)RemoteInteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "Servicio de nombres PAM que mapea a los ajustes de política GPO "
 "(Deny)NetworkLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "Servicio de nombres PAM que mapea a los ajustes de política GPO "
 "(Deny)BatchLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "Servicio de nombres PAM que mapea a los ajustes de política GPO "
 "(Deny)ServiceLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 "Servicio de nombres PAM por el que el acceso basado en GPO será siempre "
 "alcanzado"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 "Servicio de nombres PAM por el que el acceso basado en GPO será siempre "
 "denegado"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Derecho de acceso por defecto (o permitir/denegar) a usar por el servicio de "
 "nombres PAM no mapeado"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "un sitio concreto a ser usado por el cliente"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Edad máxima en días antes de que la cuenta de contraseña debería ser renovada"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Opción para afinar la tarea de renovación de la cuenta de la máquina"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 "Ya sea para actualizar la contraseña de la cuenta de la máquina en la base "
 "de datos de Samba"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Utiliza el puerto LDAPS para peticiones LDAP y Global Catalog"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "No filtra los grupos del dominio local de otros dominios"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Dirección del servidor Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Dirección del servidor de respaldo Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Reinado Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Expiración de la autenticación"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Si se crean ficheros kdcinfo"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Dónde soltar los fragmentos de configuración de krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Directorio donde almacenar las credenciales cacheadas"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Ubicación del caché de credenciales del usuario"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Ubicación de la tabla de claves para validar las credenciales"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Habilitar la validación de credenciales"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "Si se encuentra desconectado, almacena contraseñas para más tarde realizar "
 "una autenticación en línea"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "ciclo de vida renovable del TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "ciclo de vida del TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Tiempo entre dos comprobaciones para renovación"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Habilita FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Selecciona el principal para su uso por FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "Usar PKINIT anónimo para peticiciones de credenciales FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Habilita canonicalización principal"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Permite los principios de la empresa"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Habilita el uso de reinos de subdominios para autenticación"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 "Un mapeo desde los nombres de usuario a los nombres de principal de Kerberos"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "El servidor en donde está ejecutándose el servicio de modificación de "
 "contraseña, en caso de no ser KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, El URI del servidor LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, La URI del servidor LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "DN base predeterminado"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "El Tipo de Esquema a usar en el servidor LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Modo usado para cambiar la contraseña de usuario"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "El DN Bind predeterminado"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "El tipo del token de autenticación del DN bind predeterminado"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "El token de autenticación del DN bind predeterminado"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Tiempo durante el que se intentará la conexión"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Tiempo durante el que se intentará operaciones LDAP sincrónicas"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Tiempo entre intentos de reconexión cuando esté fuera de línea"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Use solo el caso superior para nombres reales"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Archivo que contiene los certificados CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Ruta hacia un directorio certificado CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Fichero que contiene el certificado de cliente"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Fichero que contiene la llave de cliente"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Lista de posibles suites de cifrado"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Requiere la verificación de certificado TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Especificar el mecanismo sasl a usar"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Especifique el id de autorización sasl a usar"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Especifica el reinado de autorización sasl a ser utilizado"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Especificar los SSF mínimos para autorizaciones sasl de LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "Especifica el SSF máximo para autorización sasl LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Tabla de clave del servicio Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Usar auth Kerberos para la conexión LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Seguir referencias LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Período de vida del TGT para la conexión LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Como eliminar aliases"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Nombre de servicio para busquedas de servicios DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "La cantidad de registros a ser obtenidos en una única consulta LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "La cantidad de miembros que deben faltar para desencadenar una deref completa"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Ignorar las referencias LDAP no legibles"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1425,7 +1420,7 @@ msgstr ""
 "Si la Biblioteca LDAP debería realizar una búsqueda inversa para "
 "canonicalizar el nombre del host durante un enlace SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1433,32 +1428,38 @@ msgstr ""
 "Permite retener los usuarios locales como miembros de un grupo LDAP para "
 "servidores que usan el esquema RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "atributo entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "atributo lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "El período de tiempo máximo para retener una conexión con el servidor LDAP "
 "antes de desconectar"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Deshabilita el control de paginación LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Deshabilitar el rango de recuperación Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "Utilizar la extensión ppolicy"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Tiempo máximo a esperar un pedido de búsqueda"
@@ -2067,33 +2068,33 @@ msgstr "Ruta de las fuentes del fichero passwd"
 msgid "Path of group file sources."
 msgstr "Ruta de las fuentes del fichero group"
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "El comando post-delete falló: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Convertirse en demonio (predeterminado)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Ejecutarse en forma interactiva (no un demonio)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Muestra el número de versión y finaliza"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -2101,97 +2102,97 @@ msgid ""
 "\n"
 msgstr "El comando post-delete falló: %1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "La opción -i|--interactive no está permitida junto con -D|--daemon\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Falta memoria\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Un arhivo abierto de descriptor para los registros de depuración"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "El usuario para crear FAST ccache como"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "El grupo para crear FAST ccache como"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Reino Kerberos a usar"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Tiempo de vida pedido del ticket"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Teimpo de vida renovable pedido del ticket"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "Opciones FAST ('never', 'try', 'demand')"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "Especifica el servidor principal a usar por FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Solicita la canonización del nombre principal"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Usar versión personal de krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf falló.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd falló.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Dominio del proveedor de información (obligatorio)"
 
@@ -2226,65 +2227,65 @@ msgid "Unexpected error while looking for an error description"
 msgstr ""
 "Ha ocurrido un error no esperado mientras se buscaba la descripción del error"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Permiso denegado."
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Mensaje del servidor:"
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Las contraseñas no coinciden"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "No existe soporte para reseteado de la contraseña por el usuario root."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Autenticado mediante credenciales cacheada"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", su contraseña cacheada vencerá el:"
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Su contraseña ha expirado. Usted tiene %1$d accesos restantes."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Su contraseña expirará en %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "Su contraseña expirará en %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "La autenticación ha sido denegada hasta:"
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "El sistema está fuera de línea, no se puede cambiar la contraseña"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2292,76 +2293,76 @@ msgstr ""
 "Después de cambiar la contraseña OTP, usted debe salir y volver a entrar con "
 "el objetivo de fijarla"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Falló el cambio de contraseña."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nueva contraseña: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Reingrese la contraseña nueva:"
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Primer Factor: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Segundo Factor (opcional): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Segundo Factor:"
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Contraseña: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Primer Factor (Contraseña Actual): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Contraseña actual: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "La contraseña ha expirado. Modifíquela en este preciso momento."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Nivel de depuración en que se debe ejecutar"
 
@@ -2370,7 +2371,7 @@ msgstr "Nivel de depuración en que se debe ejecutar"
 msgid "The SSSD domain to use"
 msgstr "El dominio SSSD a usar"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Error al poner la región\n"
 
@@ -2432,86 +2433,90 @@ msgstr "sss_ssh_knownhostsproxy: conectar al host %s puerto %d: %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: Podría no resolver el nombre de host %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 "No hay objetos en el cache que coincidan con la búsqueda especificada\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "No podría invalidar %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "No podría invalidar %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Invalidar todas las entradas en el cache"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Usuario particular invalidado"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Todos los usuarios invalidados"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Invalidar grupo concreto"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Invalidar todos los grupos"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Invalidar un grupo de red concreto"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Invalidar todos los grupos de red"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Invalidar un servicio concreto"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Invalidar todos los servicios"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Invalidar mapa autofs concreto"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Invalidar todos los mapas autofs"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Invalidar SSH host concreto"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Invalidar todos los hosts SSH"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Invalidar una regla sudo concreta"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Invalidar todas las reglas sudo cacheadas"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Solo invalidar las entradas de un dominio concreto"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2519,11 +2524,11 @@ msgstr ""
 "Se han suministrado argumento(s) no esperado, opciones que invalidan un "
 "único objeto solo aceptan que se les suministre un único argumento.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Por favor seleccione al menos un objeto par invalidar\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2533,7 +2538,7 @@ msgstr ""
 "confiable), use el nombre totalmente cualificado en lugar de --domain/-d "
 "parametro.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "No podría abrir los dominios disponibles\n"
 
@@ -2567,176 +2572,176 @@ msgstr "Incapaz de leer la entrada del usuario\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Entrada no válida, por favor suministre bien '%s' o bien '%s'.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Error mientras se ejecutaba comando externo\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Error ejecutando comando externo '%s'\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "Comando '%s' falló con [%d]\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "SSSD necesita estar corriendo. ¿Arrancar SSSD ahora?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "SSSD no debe estar corriendo. ¿Parar SSSD ahora?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "SSSD necesita ser reiniciado. ¿Reiniciar SSSD ahora?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 #, fuzzy
 msgid "List available domains"
 msgstr "No podría abrir los dominios disponibles\n"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 #, fuzzy
 msgid "Print information about domain"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 #, fuzzy
 msgid "Information about cached content:"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 #, fuzzy
 msgid "Information about cached group"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 #, fuzzy
 msgid "Information about cached netgroup"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 #, fuzzy
 msgid "Backup local data"
 msgstr "Creando respaldo de los datos locales...\n"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 #, fuzzy
 msgid "Restore local data from backup"
 msgstr "Restaurando datos locales...\n"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 #, fuzzy
 msgid "Invalidate cached objects"
 msgstr "Invalidar todas las entradas en el cache"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 #, fuzzy
 msgid "Remove existing SSSD log files"
 msgstr "Borrando ficheros de registro...\n"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 #, fuzzy
 msgid "Archive SSSD log files in tarball"
 msgstr "Archivando ficheros de registro en %s...\n"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 #, fuzzy
 msgid "Change or print information about SSSD debug level"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 #, fuzzy
 msgid "Print information about the certificate"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 #, fuzzy
 msgid "Show users mapped to the certificate"
 msgstr "Ruta al almacenamiento de los certificados CA de confianza"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2791,7 +2796,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Error: Incapaz para obtener objeto [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: Incapaz de leer el valor [%d]: %s\n"
@@ -2805,219 +2810,219 @@ msgstr "Especificar nombre."
 msgid "Unable to parse name %s.\n"
 msgstr "Incapaz de analizar el nombre %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Búsqueda por SID"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Búsqueda por ID de usuario"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Tiempo de expiración de Initgroups"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Búsqueda por ID de grupo"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 #, fuzzy
 msgid "Search by GPO guid"
 msgstr "Búsqueda por ID de grupo"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, fuzzy, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Incapaz de analizar el nombre %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, fuzzy, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Falló al abrir %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 #, fuzzy
 msgid "talloc failed\n"
 msgstr "malloc falló.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 #, fuzzy
 msgid "Unable to get attribute list!\n"
 msgstr "Incapaz de obtener la lista de servidores\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "Incapaz de borrar ficheros en cache\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 #, fuzzy
 msgid "Unable to get GPOs base DN\n"
 msgstr "Incapaz de obtener la lista de servidores\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, fuzzy, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Incapaz de archivar los ficheros de registro\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, fuzzy, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "¡Incapaz de conectar al bus del sistema!\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, fuzzy, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Incapaz de borrar los ficheros de registro\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, fuzzy, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Falló al abrir %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "No podría abrir los dominios disponibles\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, fuzzy, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Falló al abrir %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "¡Incapaz de conectar al bus del sistema!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 #, fuzzy
 msgid "Unable to parse command arguments\n"
 msgstr "Incapaz de analizar el nombre %s.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "¡Fuera de memoria!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 #, fuzzy
 msgid "Failed to decode base64 string.\n"
 msgstr "Falló al abrir %s\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -3026,7 +3031,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -3037,36 +3042,36 @@ msgstr ""
 "configuración principal. Por ejemplo si la configuración está establecida a "
 "\"/my/path/sssd.conf\", se usa el directorio retazo \"/my/path/conf.d\")"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "No existe el archivo %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 #, fuzzy
 msgid "There is no configuration.\n"
 msgstr "Fallo al cargar la configuración desde %s.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, fuzzy, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Falló al abrir %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Falló al ejecutar los validadores"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Cuestiones identificadas por los validadores: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Mensajes generados durante la configuración de la fusión: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Configuración usada ficheros retazos: %zu\n"
@@ -3088,289 +3093,289 @@ msgstr "Incapaz de exportar usuarios anulados\n"
 msgid "Unable to export group overrides\n"
 msgstr "Incapaz de exportar grupos anulados\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Anular respaldo existente"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Incapaz de importar usuario anulado\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Incapaz de importar grupo anulado\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Arrancar SSSD si no está corriendo"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Reiniciar SSSD después de la importación de datos"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Crear limpiar ficheros cache e importar datos locales"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Para SSSD antes de borrar el cache"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Iniciar SSSD cuando se haya borrado el cache"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Creando respaldo de los datos locales...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "Incapaz de crear el respaldo de los datos locales, no se puede quitar el "
 "cache.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Borrando los ficheros del cache...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Incapaz de borrar ficheros en cache\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Restaurando datos locales...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "Dominio IPA"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "Atributo UID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Proveedor de Autenticación"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, fuzzy, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "El comando post-delete falló: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 "Muestra la lista de dominio incluyendo los tipos de dominios primarios y de "
 "confianza"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "En línea"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Fuera de línea"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Estado en línea: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "Este dominio no tiene servidores activos.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Servidores activos:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "no conectado"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "No se descubrieron servidores.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "Descubiertos %s servidores:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Ninguno tan lejos.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Mostrar el estado en línea"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Mostrar información sobre el servidor activo"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Mostrar la lista de servidores descubiertos"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Especificar el nombre de dominio."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Incapaz de obtener el estado en línea\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Incapaz de obtener la lista de servidores\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "SSSD ya está corriendo\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Borrar los ficheros de registro en lugar de dividirlos"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Borrando ficheros de registro...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Incapaz de borrar los ficheros de registro\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Truncando ficheros de registro...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Incapaz de truncar los ficheros de registro\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Archivando ficheros de registro en %s...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Incapaz de archivar los ficheros de registro\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 #, fuzzy
 msgid "Target the PAM service"
 msgstr "listado de atributos de servicios PAM autorizados"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Especifique el nivel de depuración que desea fijar"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 #, fuzzy
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
@@ -3438,19 +3443,19 @@ msgstr ""
 " - shell: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "Acción PAM [auth|acct|setc|chau|open|clos], predeterminada: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "Servicio PAM, predeterminado: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Especificar nombre de usuario."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3463,22 +3468,22 @@ msgstr ""
 "servicio: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "Búsqueda de nombre de usuario con [%s] falló.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "Búsqueda de Usuario InfoPipe con [%s] falló.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start falló: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3486,12 +3491,12 @@ msgstr ""
 "probando pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item falló: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3500,7 +3505,7 @@ msgstr ""
 "pam_authenticate para usuario [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3508,7 +3513,7 @@ msgstr ""
 "probando pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3517,7 +3522,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3525,7 +3530,7 @@ msgstr ""
 "probando pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3534,7 +3539,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3542,7 +3547,7 @@ msgstr ""
 "probando pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3551,7 +3556,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3559,7 +3564,7 @@ msgstr ""
 "probando pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3568,7 +3573,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3576,7 +3581,7 @@ msgstr ""
 "probando pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3585,26 +3590,30 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "acción desconocida\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "Entorno PAM:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - no env -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Indicar un archivo de configuración diferente al predeterminado"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Informa que el contestador ha sido socket-activated"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr ""
+#~ "Número de veces que debe intentar la conexión con los Proveedores de Datos"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Deshabilitar el interfaz netlink"
 
diff --git a/po/eu.po b/po/eu.po
index b96681f83b5..d7cc1a8d3c2 100644
--- a/po/eu.po
+++ b/po/eu.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:45-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Basque (http://www.transifex.com/projects/p/sssd/language/"
@@ -46,26 +46,22 @@ msgid "Command to start service"
 msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -73,63 +69,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -137,1131 +133,1137 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Gutxienezko erabiltzaile IDa"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Gehienezko erabiltzaile IDa"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA domeinua"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA zerbitzariaren helbidea"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA bezeroaren ostalari-izena"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "FAST gaitzen du"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN atributua"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN atributua"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1845,32 +1847,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Inprimatu bertsio zenbakia eta irten"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1878,97 +1880,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2000,140 +2002,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "Huts egin du pasahitza aldatzeak. "
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Huts egin du pasahitza aldatzeak. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Pasahitz berria: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Berriz sartu pasahitz berria: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Pasahitza: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Uneko pasahitza: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Pasahitza iraungita. Aldatu zure pasahitza orain."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2142,7 +2144,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2204,102 +2206,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Baliogabetu erabiltzaile bat"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Baliogabetu erabiltzaile guztiak"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Baliogabetu talde bat"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Baliogabetu talde guztiak"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Baliogabetu zerbitzu bat"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Baliogabetu zerbitzu guztiak"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2333,162 +2339,162 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 #, fuzzy
 msgid "Invalidate cached objects"
 msgstr "Baliogabetu erabiltzaile guztiak"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2543,7 +2549,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2557,211 +2563,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2770,42 +2776,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2827,282 +2833,282 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA domeinua"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "UID atributua"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3165,19 +3171,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3186,121 +3192,121 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
diff --git a/po/fi.po b/po/fi.po
index 7576d43789b..fb31aa79ce4 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-05-08 19:36+0000\n"
 "Last-Translator: Weblate Translation Memory <noreply-mt-weblate-translation-"
 "memory@weblate.org>\n"
@@ -46,26 +46,22 @@ msgid "Command to start service"
 msgstr "Komento jolla palvelu käynnistetään"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Kuinka monta kertaa yritetään muodostaa yhteys tietojen tarjoajiin"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "Tiedostokuvaajien määrä, jonka tämä vastaaja voi avata"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Joutilasaika ennen asiakkaan automaattista yhteyden katkaisua"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Joutilasaika ennen vastaajan automaattista sammutusta"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "Kysele aina kaikki välimuistit, ennen kuin kysyt tietojen tarjoajilta"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -77,23 +73,23 @@ msgstr ""
 "Tämä arvo on sekunteina ja se lasketaan seuraavasti: yhteydettömän tilan "
 "aikakatkaisu + satunnainen_poikkeama."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Käynnistettävät SSSD-palvelut"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Käynnistettävät SSSD-toimialueet"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Käyttäjänimen ja toimialueen jäsentävä säännöllinen lauseke"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Printf-yhteensopiva muoto täysin pätevien nimien näyttämiseen"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -101,37 +97,37 @@ msgstr ""
 "Tiedostojärjestelmän hakemisto, johon SSSD: n tulisi tallentaa Kerberos-"
 "toiston välimuistitiedostot."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Toimialue, joka lisätään nimiin ilman toimialuekomponenttia."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Käyttäjä, jolle luovutetaan oikeudet"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Viritä varmenteen vahvistus"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Kaikki välilyönnit ryhmien nimissä tai käyttäjätunnuksissa korvataan tällä "
 "merkillä"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "Viritä sssd kunnioittamaan tai ohittamaan netlinkin tilan muutokset"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Ota käyttöön tai poista käytöstä implisiittinen tiedostojen toimialue"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Haettavien toimialueiden määritetty järjestys"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -139,7 +135,7 @@ msgstr ""
 "Määrittää, pitäisikö SSSD:n valvoa resolv.conf-tiedoston tilaa "
 "tunnistaakseen, milloin sen on päivitettävä sisäinen DNS-selvittäjä."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -151,77 +147,77 @@ msgstr ""
 "tähän ja palaamme tarkkailemaan resolv.conf-tiedostoa viiden sekunnin "
 "välein, jos inotifyta ei voida käyttää."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "Suorita PAC-vastaaja automaattisesti AD- ja IPA-palveluntarjoajalle"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 "Ota ytimen tyhjennys käyttöön tai poista se käytöstä kaikissa SSSD-"
 "prosesseissa."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Säädä salasanan vahvistuskäyttäytymistä"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Luettelovälimuistin aikakatkaisun pituus (sekunteina)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Syötevälimuistin taustapäivityksen aikakatkaisun pituus (sekunteina)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Negatiivinen välimuistin aikakatkaisun pituus (sekunteina)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Tiedostojen negatiivisen välimuistin aikakatkaisun pituus (sekunteina)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Käyttäjät, jotka SSSD:n tulee jättää huomiotta"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Ryhmät, jotka SSSD:n tulee jättää huomiotta"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Pitäisikö suodatettujen käyttäjien näkyä ryhmissä"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Salasanakentän arvo, joka NSS-palveluntarjoajan tulee palauttaa"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr "Korvaa identiteetintarjoajan homedir-arvo tällä arvolla"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr "Korvaa identiteetintarjoajan tyhjä homedir-arvo tällä arvolla"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "Korvaa identiteetintarjoajan komentotulkki-arvo tällä arvolla"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Luettelo komentotulkeista, joilla käyttäjät voivat kirjautua sisään"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "Luettelo komentotulkeista, jotka estetään ja korvataan peruskomentotulkilla"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -229,1058 +225,1064 @@ msgstr ""
 "Jos keskushakemistoon tallennettu komentotulkki on sallittu, mutta se ei ole "
 "käytettävissä, käytä tätä varavaihtoehtoa"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Ota toimialue käyttöön tai poista se käytöstä"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Välimuistin aikakatkaisun pituus (sekunteina)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Korvaa identiteetintarjoajan GID-arvo tällä arvolla"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1864,32 +1866,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1897,97 +1899,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Muisti loppui!\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2019,140 +2021,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Käyttö estetty "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Salasanat eivät täsmää"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Salasanan vaihtaminen epäonnistui. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Uusi salasana: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Salasana: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Nykyinen salasana: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2161,7 +2163,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2223,102 +2225,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2352,161 +2358,161 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2561,7 +2567,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2575,212 +2581,212 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, fuzzy, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Komennon argumentteja ei voi jäsentää\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, fuzzy, c-format
 msgid "Failed to print object: %s\n"
 msgstr "tiedoston %s lukeminen epäonnistui: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "Varmuuskopiohakemistoa ei voi luoda [%d]: %s"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, fuzzy, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "tiedoston %s lukeminen epäonnistui: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, fuzzy, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "tiedoston %s lukeminen epäonnistui: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, fuzzy, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "tiedoston %s lukeminen epäonnistui: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Komennon argumentteja ei voi jäsentää\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Muisti loppui!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Base64-merkkijonon purkaminen epäonnistui.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2789,42 +2795,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "Tiedostoa %1$s ei ole olemassa.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "tiedoston %s lukeminen epäonnistui: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2846,280 +2852,280 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "toimialue"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "attribuutti"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "yhteydetön"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "Ei yhdistetty"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3182,19 +3188,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3203,124 +3209,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "tuntematon valitsin\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Kuinka monta kertaa yritetään muodostaa yhteys tietojen tarjoajiin"
+
 #~ msgid ""
 #~ "Indicates what is the syntax of the config file. SSSD 0.6.0 and later use "
 #~ "version 2."
diff --git a/po/fr.po b/po/fr.po
index 251f9c0578d..e0c006f5083 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -19,7 +19,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-09-02 11:38+0000\n"
 "Last-Translator: Léane GRASSER <leane.grasser@proton.me>\n"
 "Language-Team: French <https://translate.fedoraproject.org/projects/sssd/"
@@ -58,30 +58,26 @@ msgid "Command to start service"
 msgstr "Commande pour démarrer le service"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Nombre d'essais pour tenter de se connecter au fournisseur de données"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "Le nombre de descripteurs de fichiers qui peuvent être ouverts par ce "
 "répondeur"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "durée d'inactivité avant la déconnexion automatique d'un client"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Temps d'inactivité avant l'arrêt automatique du répondeur"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 "Interrogez toujours tous les caches avant d'interroger les fournisseurs de "
 "données"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -93,23 +89,23 @@ msgstr ""
 "Cette valeur est exprimée en secondes et calculée comme suit : "
 "offline_timeout + random_offset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Services SSSD à démarrer"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Domaines SSSD à démarrer"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Expression rationnelle d'analyse des noms d'utilisateur et de domaine"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Format compatible printf d'affichage des noms complétement qualifiés"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -117,37 +113,37 @@ msgstr ""
 "Répertoire du système de fichiers où SSSD doit stocker les fichiers de "
 "relecture de Kerberos."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Domaine à ajouter aux noms sans composant de nom de domaine."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "L'utilisation vers lequel abandonner les privilèges"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Régler la vérification du certificat"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Tous les espaces dans les noms de groupes ou d'utilisateurs seront remplacés "
 "par ce caractère"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "Régler sssd pour honorer ou ignorer les changements d'état du netlink"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Activer ou désactiver le domaine des fichiers implicites"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Un ordre spécifique des domaines à rechercher"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -155,7 +151,7 @@ msgstr ""
 "Contrôle si le SSSD doit surveiller l'état de resolv.conf pour identifier "
 "quand il doit mettre à jour son résolveur DNS interne."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -167,83 +163,83 @@ msgstr ""
 "d'utiliser inotify pour cela, et par défaut, resolv.conf sera interrogé "
 "toutes les cinq secondes si inotify ne peut pas être utilisé."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "Exécution automatique du répondeur PAC pour le fournisseur AD et IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 "Activer ou désactiver les vidages de noyau pour tous les processus SSSD."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Ajustez le comportement de la vérification de la clé de sécurité"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Délai d'attente du cache d'énumération (en secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 "Délai d'attente de mise à jour en arrière-plan de l'entrée de cache (en "
 "secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Délai d'attente du cache négatif (en secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Délai d'attente du cache négatif (en secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Utilisateurs que SSSD doit explicitement ignorer"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Groupes que SSSD doit explicitement ignorer"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Les utilisateurs filtrés doivent-ils apparaître dans les groupes"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Valeur du champ de mot de passe que le fournisseur NSS doit renvoyer"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Remplacer par cette valeur celle du répertoire personnel obtenu avec le "
 "fournisseur d'identité"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Substitution de la valeur homedir vide du fournisseur d'identité avec cette "
 "valeur"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "Écraser le shell donné par le fournisseur d'identité avec cette valeur"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 "Liste des interpréteurs de commandes utilisateurs autorisés pour se connecter"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "Liste des interpréteurs de commandes bannis et remplacés par celui par défaut"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -251,15 +247,15 @@ msgstr ""
 "Si un interpréteur de commandes stocké dans l'annuaire central est autorisé "
 "mais indisponible, utiliser à défaut celui-ci"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Shell à utiliser si le fournisseur n'en propose aucun"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Durée de maintien en cache des enregistrements valides"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -267,7 +263,7 @@ msgstr ""
 "Taille (en mégaoctets) de la table de données allouée dans le cache en "
 "mémoire rapide pour les demandes de mots de passe"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -275,7 +271,7 @@ msgstr ""
 "Taille (en mégaoctets) de la table de données allouée dans le cache en "
 "mémoire rapide pour les requêtes de groupe"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -283,7 +279,7 @@ msgstr ""
 "Taille (en mégaoctets) de la table de données allouée dans le cache en "
 "mémoire rapide pour les demandes d'initgroups"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -291,7 +287,7 @@ msgstr ""
 "La valeur de cette option sera utilisée dans l'extension de l'option "
 "override_homedir si le modèle contient la chaîne de format %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -299,7 +295,7 @@ msgstr ""
 "Spécifie la durée en secondes pendant laquelle la liste de sous-domaines est "
 "jugée valide."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -309,17 +305,17 @@ msgstr ""
 "entrées en arrière plan si la requête ne dépasse pas un pourcentage de la "
 "valeur de entry_cache_timeout pour le domaine."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Délai pendant lequel les connexions utilisant le cache sont autorisées entre "
 "deux connexions en ligne (en jours)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Nombre d'échecs de connexions hors-ligne autorisés"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -327,98 +323,98 @@ msgstr ""
 "Durée d'interdiction de connexion après que offline_failed_login_attempts "
 "est atteint (en minutes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 "Quels types de messages sont affichés à l'utilisateur pendant "
 "l'authentification"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Filtrez les réponses PAM envoyées à l'adresse pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Durée en secondes pendant laquelle les informations d'identité sont gardées "
 "en cache pour les requêtes PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 "Nombre de jours précédent l'expiration du mot de passe avant lesquels un "
 "avertissement doit être affiché"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Liste des uid ou noms d'utilisateurs dignes de confiance"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 "Liste des domaines accessibles y compris par les utilisateurs non dignes de "
 "confiance."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "Message affiché lorsque le compte a expiré."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "Message affiché lorsque le compte a expiré."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Autoriser l'authentification par certificat/carte à puce."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 "Chemin d'accès à la base de données des certificats des modules PKCS#11."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Régler la vérification du certificat d’authentification PAM."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "Combien de secondes pam_sss attendra-t-il la fin de p11_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 "Quels services PAM sont autorisés à contacter les domaines d'application"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Services autorisés pour l'utilisation de cartes à puce"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Délai d'attente supplémentaire pour l'obtention d'une carte si demandé"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "URI PKCS#11 pour limiter la sélection des périphériques pour "
 "l'authentification par carte à puce"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "Quand le répondeur de PAM doit-il forcer une demande d'initgroupes"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 "Liste des services PAM qui sont autorisés à s'authentifier avec GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 "S'il faut faire correspondre l'UPN authentifié avec l'utilisateur cible"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -426,28 +422,28 @@ msgstr ""
 "Liste des paires <PAM service>:<authentication indicator> qui doivent être "
 "appliquées pour l'accès PAM avec authentification GSSAPI"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Autoriser l'authentification des périphériques par mot de passe."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 "Combien de secondes pam_sss attendra-t-il que passkey_child ait terminé ?"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Activer le débogage dans la bibliothèque libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "Faut-il évaluer les attributs dépendants du temps dans les règles sudo"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "Si sur true, SSSD repasse en logique de commande à faible gain"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -455,12 +451,12 @@ msgstr ""
 "Nombre maximum de règles pouvant être rafraîchies en même temps. En cas de "
 "dépassement, un rafraîchissement complet est effectué."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "Condenser ou non les noms de systèmes et adresses du fichier known_hosts"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -468,15 +464,15 @@ msgstr ""
 "Le nombre de secondes pour garder un hôte dans le fichier known_hosts après "
 "que ses clés d'hôte ont été demandées"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Chemin d'accès au stockage des certificats d'AC de confiance"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Permet de générer des ssh-keys à partir de certificats"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -484,24 +480,24 @@ msgstr ""
 "Utilisez les règles de correspondance suivantes pour filtrer les certificats "
 "pour la génération de clés ssh"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Listes des UID ou nom d'utilisateurs autorisés à accéder le répondeur PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Durée de validité des données du PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Valider le PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Liste des attributs utilisateur que l'InfoPipe est autorisé à publier"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -512,7 +508,7 @@ msgstr ""
 "groupes spécifiés par les options des utilisateurs et des groupes sont "
 "enregistrés. all - Tous les utilisateurs sont enregistrés."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -523,7 +519,7 @@ msgstr ""
 "le NSS. C'est-à-dire après le remplacement éventuel de l'espace, les "
 "changements de casse, etc."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -534,7 +530,7 @@ msgstr ""
 "renvoyés par le NSS, c-à-d après le remplacement éventuel de l'espace, les "
 "changements de cas, etc."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -542,7 +538,7 @@ msgstr ""
 "Une liste d'utilisateurs à exclure de l'enregistrement, séparés par des "
 "virgules, uniquement lorsque scope=all"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -550,101 +546,101 @@ msgstr ""
 "Une liste de groupes séparés par des virgules, dont les membres doivent être "
 "exclus de l'enregistrement, uniquement lorsque scope=all. "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Fournisseur d'identité"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Fournisseur d'authentification"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Fournisseur de contrôle d'accès"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Fournisseur de changement de mot de passe"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Fournisseur SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Fournisseur autofs"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Fournisseur d'identité de l'hôte"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "Fournisseur SELinux"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Fournisseur de gestion de session"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Fournisseur de résolveurs"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "Si le domaine est utilisable par l'OS ou par des applications"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Activer ou désactiver le domaine"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Identifiant utilisateur minimum"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Identifiant utilisateur maximum"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Activer l'énumération de tous les utilisateurs/groupes"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Mettre en cache les crédits pour une connexion hors-ligne"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Afficher les utilisateurs/groupes dans un format complétement qualifié"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Ne pas inclure les membres des groupes dans les recherches de groupes"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Durée de validité des entrées en cache (en secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr "Restreindre ou préférer une famille d'adresses lors des recherches DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Durée de validité des entrées en cache après la dernière connexion réussie "
 "(en jours)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -652,23 +648,23 @@ msgstr ""
 "Combien de temps le SSSD doit-il parler à un seul serveur DNS avant "
 "d'essayer le serveur suivant (en millisecondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 "Combien de temps faut-il continuer à essayer de résoudre une seule requête "
 "DNS (en secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Délai d'attente des réponses du DNS lors de la résolution des serveurs (en "
 "secondes)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "La partie domaine de la requête de découverte de service DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -678,114 +674,114 @@ msgstr ""
 "d'essayer de se reconnecter au serveur principal après une connexion réussie "
 "au serveur de secours"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Écraser la valeur du GID du fournisseur d'identité avec cette valeur"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Considère les noms d'utilisateur comme casse dépendant"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Fréquence de rafraîchissement en arrière plan des entrées expirées"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 "Écart maximal de période lors du rafraîchissement des entrées expirées en "
 "arrière-plan"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Choisir de mettre à jour automatiquement l'entrée DNS du client"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "Le TTL à appliquer à l'entrée DNS du client après modification"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "L'interface dont l'adresse IP doit être utilisée pour les mises à jour "
 "dynamiques du DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Fréquence de mise à jour automatique de l'entrée DNS du client"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 "Déviation maximale de la période lors de la mise à jour de l'entrée DNS du "
 "client"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 "Selon que le fournisseur doit aussi ou non mettre à jour explicitement "
 "l'enregistrement PTR"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Selon que l'utilitaire nsupdate doit utiliser TCP par défaut"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Quel type d'authentification doit être utilisée pour effectuer la mise à "
 "jour DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "Remplace le serveur DNS utilisé pour effectuer la mise à jour du DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Contrôle l'énumération des domaines approuvés"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Fréquence de rafraîchissement des sous-domaines"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 "Écart de période maximum lors du rafraîchissement de la liste des sous-"
 "domaines"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Listes des options qui doivent être héritées dans le sous-domaine"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Valeur par défaut du sous-domaine homedir"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Combien de temps les informations d'identification en cache peuvent-elles "
 "être utilisées pour l'authentification en cache"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "Créer automatiquement un groupe privé pour chacun des utilisateurs"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Afficher une alerte N jours avant l'expiration du mot de passe."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Étiquettes diverses stockées par le service de configuration de realmd pour "
 "ce domaine."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -793,7 +789,7 @@ msgstr ""
 "Le fournisseur doit être capable de gérer la récupération des sous-domaines. "
 "Cette valeur doit être toujours identique à id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -801,7 +797,7 @@ msgstr ""
 "La durée en secondes pendant laquelle conserver une clé ssh d'hôte après "
 "rafraichissement. I.e. combien de temps mettre la clé en cache."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -813,105 +809,105 @@ msgstr ""
 "passe à long terme) doit être sauvegardé en tant que hachage SHA512 dans le "
 "cache."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Politique des méthodes d'authentification locale "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Domaine IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Adresse du serveur IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adresse du serveur IPA de secours"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Nom de système du client IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "Choisir de mettre à jour automatiquement l'entrée DNS du client dans FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Base de recherche pour les objets HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "Délai entre les recherches de règles HBAC sur le serveur IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr "Délai entre les recherches de cartes SELinux sur le serveur IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr "Si mit à false, l’argument de l'hôte donné par PAM est ignoré"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 "L'emplacement de la carte de montage automatique utilisée par le client IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 "Base de recherche pour l'objet contenant les informations de base à propos "
 "du domaine IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 "Base de recherche pour les objets contenant les informations à propos des "
 "plages d'ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Activer les sites DNS - découverte de service basée sur l'emplacement"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Base de recherche des conteneurs de vues"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Classe d'objet pour les conteneurs de vues"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Attribut avec le nom de la vue"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Classe d'objet surchargeant les objets"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Attribut faisant référence à l'objet originel"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Classe d'objet surchargeant les utilisateurs"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Classe d'objet surchargeant les groupes"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Base de recherche pour les objets liés au Profil du Bureau"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -919,7 +915,7 @@ msgstr ""
 "Le temps, en secondes, entre les consultations des règles du profil du "
 "bureau sur le serveur IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -927,42 +923,42 @@ msgstr ""
 "Le temps en minutes entre les consultations des règles de profile de bureau "
 "sur le serveur IPA lorsque la dernière requête n'a trouvé aucune règle"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "Base de recherche pour les plages SUBID"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Quelles règles utiliser pour évaluer le contrôle d'accès"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "L'attribut LDAP qui contient le FQDN de l'hôte."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "La classe d'objet d'une entrée utilisateur dans LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 "Utiliser la chaîne donnée comme base de recherche pour héberger des objets."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "L'attribut LDAP qui contient les clés publiques SSH de l'hôte."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "L'attribut LDAP qui contient le nom de domaine NIS du netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "L'attribut LDAP contenant les noms des membres du netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -970,7 +966,7 @@ msgstr ""
 "L'attribut LDAP qui répertorie les FQDN des hôtes et des groupes d'hôtes qui "
 "sont membres du netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -978,11 +974,11 @@ msgstr ""
 "L'attribut LDAP qui répertorie les hôtes et les groupes d'hôtes qui sont des "
 "membres directs du netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "L'attribut LDAP qui répertorie les adhésions au netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -990,20 +986,20 @@ msgstr ""
 "L'attribut LDAP qui répertorie les utilisateurs du système et les groupes "
 "qui sont des membres directs du netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "L'attribut LDAP correspondant au nom du netgroup."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "La classe d'objet d'une entrée de netgroup dans LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "L'attribut LDAP qui contient l'UUID/GUID d'un objet de netgroup LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -1011,11 +1007,11 @@ msgstr ""
 "L'attribut LDAP qui contient l’information de savoir si la carte "
 "d'utilisateur est activée ou non pour l'utilisation."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "L'attribut LDAP qui contient la catégorie d'hôte telle que \"all\"."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -1023,18 +1019,18 @@ msgstr ""
 "L'attribut LDAP qui contient tous les hôtes / groupes d'hôtes auxquels cette "
 "règle correspond."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "L'attribut LDAP qui contient tous les utilisateurs / groupes auxquels cette "
 "règle correspond."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "L'attribut LDAP qui contient le nom de la carte d'utilisateur SELinux."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -1042,21 +1038,21 @@ msgstr ""
 "L'attribut LDAP qui contient le DN de la règle HBAC qui peut être utilisé "
 "pour la correspondance au lieu de memberUser et memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 "L'attribut LDAP qui contient la chaîne d'utilisateur SELinux elle-même."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 "L'attribut LDAP qui contient la catégorie d'utilisateur telle que \"all\"."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "L'attribut LDAP qui contient l'ID unique de la carte de l'utilisateur."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1065,367 +1061,367 @@ msgstr ""
 "effectuer différemment les recherches des utilisateurs et des groupes des "
 "domaines approuvés."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 "Utiliser la chaîne donnée comme base de recherche pour les domaines "
 "approuvés."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Domaine Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Domaine d’Active Directory activés"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Adresse du serveur Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Adresse du serveur Active Directory de secours"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Nom de système du client Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Filtre LDAP pour déterminer les autorisations d'accès"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Choisir d'utiliser ou non le catalogue global pour les recherches"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Mode opératoire pour les contrôles d'accès basé sur les GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 "Durée entre les recherches de fichiers de stratégie GPO dans le serveur AD"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
-"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
-"InteractiveLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie "
+"(Deny)InteractiveLogonRight de la GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
-"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
-"RemoteInteractiveLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie "
+"(Deny)RemoteInteractiveLogonRight de la GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
-"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
-"NetworkLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie "
+"(Deny)NetworkLogonRight de la GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
-"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
-"BatchLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie "
+"(Deny)BatchLogonRight de la GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
-"Nom des services PAM correspondant à la configuration de la stratégie (Deny)"
-"ServiceLogonRight de la GPO"
+"Nom des services PAM correspondant à la configuration de la stratégie "
+"(Deny)ServiceLogonRight de la GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 "Noms de services PAM pour lesquels les accès s'appuyant sur la GPO sont "
 "toujours autorisés"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 "Noms de services PAM pour lesquels les accès s'appuyant sur la GPO sont "
 "toujours interdits"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Droit de connexion par défaut (ou permission/interdiction) à utiliser pour "
 "les noms de services sans correspondance"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "un site particulier utilisé par le client"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Âge maximum en jours avant que le mot de passe du compte de la machine ne "
 "soit renouvelé"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Option de réglage de la tâche de renouvellement du compte machine"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 "Indique s'il faut mettre à jour le mot de passe du compte de la machine dans "
 "la base de données Samba"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Utiliser le port LDAPS pour les requêtes LDAP et Catalogue global"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 "Ne pas filtrer les groupes locaux d'un domaine à partir d'autres domaines"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Adresse du serveur Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Adresse du serveur Kerberos de secours"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Domaine Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Délai avant expiration de l'authentification"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Choisir de créer ou non les fichiers kdcinfo"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Où déposer les extraits de configuration krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Répertoire pour stocker les caches de crédits"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Emplacement du cache de crédits de l'utilisateur"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Emplacement du fichier keytab de validation des crédits"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Activer la validation des crédits"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "Stocker le mot de passe, si hors-ligne, pour une authentification ultérieure "
 "en ligne"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Durée de vie renouvelable du TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Durée de vie du TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Durée entre deux vérifications pour le renouvellement"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Active FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Sélectionne le principal à utiliser avec FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 "Utilisez le PKINIT anonyme pour demander des informations d'identification "
 "FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Active la canonisation du principal"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Active les principals d'entreprise"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 "Permet d'utiliser les domaines de sous-domaines pour l'authentification"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 "Un mappage des noms d'utilisateurs vers les noms de principaux Kerberos"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Serveur où tourne le service de changement de mot de passe s'il n'est pas "
 "sur le KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, l'adresse du serveur LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, l'URI du serveur LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "La base DN par défaut"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Le type de schéma utilisé sur le serveur LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Mode utilisé pour modifier le mot de passe utilisateur"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Le DN de connexion par défaut"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Le type de jeton d'authentification du DN de connexion par défaut"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Le jeton d'authentification du DN de connexion par défaut"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Durée pendant laquelle il sera tenté d'établir la connexion"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Durée pendant laquelle il sera tenté des opérations LDAP synchrones"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Durée d'attente entre deux essais de reconnexion en mode hors-ligne"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "N'utiliser que des majuscules pour les noms de domaine"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Fichier contenant les certificats des CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Chemin vers le répertoire de certificats des CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Fichier contenant le certificat client"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Fichier contenant la clé du client"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Liste des suites de chiffrement possibles"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Requiert une vérification de certificat TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Spécifier le mécanisme SASL à utiliser"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Spécifier l'identité d'authorisation SASL à utiliser"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Spécifier le domaine d'authorisation SASL à utiliser"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Spécifie le minimum SSF pour l'autorisation sasl LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "Spécifie le SFF maximal pour l'autorisation sasl LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Service du fichier keytab de Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Utiliser l'authentification Kerberos pour la connexion LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Suivre les référents LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Durée de vie du TGT pour la connexion LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Comment déréférencer les alias"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Nom du service pour les recherches DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Le nombre d'enregistrements à récupérer dans une requête LDAP unique"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "Nombre de membres qui doivent être manquants pour activer un déréférencement "
 "complet"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Ignorer les références LDAP illisibles"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1433,7 +1429,7 @@ msgstr ""
 "Est-ce que la bibliothèque LDAP doit effectuer une requête pour canoniser le "
 "nom d'hôte pendant une connexion SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1441,32 +1437,38 @@ msgstr ""
 "Permet de conserver les utilisateurs locaux en tant que membres d'un groupe "
 "LDAP pour les serveurs qui utilisent le schéma RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "attribut entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "attribut lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "Combien de temps conserver la connexion au serveur LDAP avant de se "
 "déconnecter"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Désactiver le contrôle des pages LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Désactiver la récupération de plage Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "Utiliser l'extension ppolicy"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Durée d'attente pour une requête de recherche"
@@ -2079,34 +2081,34 @@ msgstr "Chemin des sources des fichiers passwd."
 msgid "Path of group file sources."
 msgstr "Chemin des sources des fichiers de groupe."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr "Échec de l'opération de configuration\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr "L'option de configuration '"
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 "Valeur '%s' non prise en charge pour l'option de configuration '%s'. "
 "Utilisez uniquement 'root' ou '"
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Devenir un démon (par défaut)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Fonctionner en interactif (non démon)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Afficher le numéro de version et quitte"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -2117,99 +2119,99 @@ msgstr ""
 "Option %s invalide : %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "Option -i|--interactive non authorisée avec -D|--daemon\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr "Échec de l'obtention des capacités initiales\n"
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 "Le programme n'a pas été compilé avec la prise en charge de l'utilisateur de "
 "service non root. Impossible de s'exécuter en tant que %"
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr "Impossible de lire la configuration : '%s'\n"
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr "Échec du démarrage du processus SSSD 'monitor' : %s"
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Mémoire saturée\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Autoriser les vidages de noyau"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Un descripteur de fichier ouvert pour les journaux de débogage"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "L'utilisateur à utiliser pour la création du ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Le groupe à utiliser pour la création du ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "Utilisez le PKINIT anonyme pour obtenir un ticket FAST armor"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Domaine Kerberos à utiliser"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Demande de renouvellement à vie du billet"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Demande de renouvellement à vie du billet"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "Options FAST ('never', 'try', 'demand')"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "Spécifie le principal de serveur afin d'utiliser FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Demande la canonisation du nom principal"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Utiliser la version personnalisée de krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "ID de chaîne Tevent utilisé à des fins de journalisation"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "Vérifier les indicateurs PAC"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "Échec de talloc_asprintf.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "Échec de set_debug_file_from_fd.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domaine du fournisseur d'informations (obligatoire)"
 
@@ -2241,16 +2243,16 @@ msgstr "Une erreur est survenue mais aucune description n'est trouvée."
 msgid "Unexpected error while looking for an error description"
 msgstr "Erreur inattendue lors de la recherche de la description de l'erreur"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Accès refusé. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Message du serveur : "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
@@ -2258,53 +2260,53 @@ msgstr ""
 "Le TGT Kerberos ne sera pas accordé lors de la connexion ; cela affectera "
 "l'expérience utilisateur."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "Saisissez le code PIN :"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Les mots de passe ne correspondent pas"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 "La réinitialisation du mot de passe par root n'est pas prise en charge."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Authentifié avec les crédits mis en cache"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", votre mot de passe en cache expirera à : "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 "Votre mot de passe a expiré. Il vous reste %1$d connexion(s) autorisée(s)."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Votre mot de passe expirera dans %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Votre mot de passe a expiré."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "L'authentification est refusée jusque : "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 "Le système est hors-ligne, les modifications du mot de passe sont impossibles"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2312,11 +2314,11 @@ msgstr ""
 "Après avoir modifié le mot de passe OTP, vous devez vous déconnecter et vous "
 "reconnecter afin d'acquérir un ticket"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN verrouillé"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2324,66 +2326,66 @@ msgstr ""
 "Aucun TGT Kerberos accordé car le serveur ne prend pas en charge cette "
 "méthode. Cela affectera votre expérience d'authentification unique (SSO)."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Échec du changement de mot de passe. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "Authentifiez-vous sur %1$s et appuyez sur ENTRÉE."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "Authentifiez-vous avec le PIN %1$s à %2$s et appuyez sur ENTRÉE."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "Veuillez (ré)insérer une carte à puce (différente)"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nouveau mot de passe : "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Retaper le nouveau mot de passe : "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Premier facteur : "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Deuxième facteur (facultatif) : "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Second facteur : "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "Insérez votre passe-partout, puis appuyez sur la touche ENTER."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Mot de passe : "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Premier facteur (mot de passe actuel) : "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Mot de passe actuel : "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Mot de passe expiré. Changez votre mot de passe maintenant."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Le niveau de débogage utilisé avec"
 
@@ -2392,7 +2394,7 @@ msgstr "Le niveau de débogage utilisé avec"
 msgid "The SSSD domain to use"
 msgstr "Le domaine SSSD à utiliser"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Erreur lors du paramétrage de la locale\n"
 
@@ -2419,13 +2421,11 @@ msgid ""
 "\n"
 msgstr ""
 "\n"
-"*****************************************************************************"
-"*\n"
+"******************************************************************************\n"
 "Votre système est configuré de manière à utiliser l'outil obsolète\n"
 "sss_ssh_knownhostsproxy.\n"
 "Lisez la page man sss_ssh_knownhosts(1) pour découvrir son remplaçant.\n"
-"*****************************************************************************"
-"*\n"
+"******************************************************************************\n"
 "\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
@@ -2465,85 +2465,89 @@ msgstr "sss_ssh_knownhostsproxy : se connecter à l'hôte %s port %d : %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy : Impossible de résoudre le nom d'hôte %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Aucun object trouvé dans le cache pour la recherche spécifiée\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "Impossible d'invalider %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "Impossible d'invalider %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Invalidez toutes les entrées en cache"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Invalider un utilisateur spécifique"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Invalider tous les utilisateurs"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Invalider un groupe particulier"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Invalider tous les groupes"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Invalider un groupe réseau particulier"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Invalider tous les groupes réseau"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Invalidation d'un service particulier"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Invalidation de tous les services"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Invalidation d'une carte autofs particulière"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Invalidation de toutes les cartes autofs"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Invalider un hôte SSH particulier"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Invalider tous les hôtes SSH"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Invalider une règle sudo particulière"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Invalider toutes les règles sudo en cache"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "N'invalider des entrées que d'un domaine spécifique"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2551,11 +2555,11 @@ msgstr ""
 "Argument(s) inattendu(s) fourni(s), les options qui invalident un seul objet "
 "n'acceptent qu'un seul argument fourni.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Merci de sélectionner au moins un objet à invalider\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2565,7 +2569,7 @@ msgstr ""
 "(domaine approuvé), utiliser le nom pleinement qualifié au lieu du paramètre "
 "--domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Impossible d'ouvrir aucun des domaines disponibles\n"
 
@@ -2599,164 +2603,164 @@ msgstr "Impossible de lire l'entrée de l'utilisateur\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Entrée non valable, veuillez fournir %s ou %s.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Erreur lors de l'exécution d'une commande externe\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Erreur lors de l’exécution de la commande externe '%s'\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "La commande '%s' a échoué avec [%d]\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "Le SSSD doit être exécuté. Démarrer le SSSD maintenant ?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 "Le SSSD ne doit pas être en cours d'exécution. Arrêter le SSSD maintenant ?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "Le SSSD doit être relancé. Redémarrer SSSD maintenant ?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "Statut SSSD :"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Liste des domaines disponibles"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Imprimer des informations sur le domaine"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 "Imprimer des informations sur un utilisateur et vérifier l'authentification"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Générer un rapport d'accès pour un domaine"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Informations sur le contenu en cache :"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Informations sur l'utilisateur en cache"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Informations sur le groupe en cache"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Informations sur le groupe réseau en cache"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Outils de données locales :"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Sauvegarde des données locales"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Restauration des données locales à partir d'une sauvegarde"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "Sauvegarde des données locales et suppression du contenu en cache"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Invalider les objets mis en cache"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Gérer les index de cache"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Outils de fichiers journaux :"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Suppression des fichiers journaux SSSD existants"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "Archiver les fichiers journaux SSSD dans un tarball"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 "Modifier ou imprimer les informations sur le niveau de débogage de SSSD"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Analyser les données enregistrées"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Outils de fichiers de configuration :"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "Effectuer une analyse statique de la configuration SSSD"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Outils liés aux certificats :"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Imprimer des informations sur le certificat"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Afficher les utilisateurs associés au certificat"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Vérifier le mappage et la règle de correspondance avec un certificat"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr "Outils liés aux GPO :"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr "Informations sur une GPO en cache"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr "Énumérer les GPO en cache"
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr "Supprimer une GPO du cache"
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr "Supprimer toutes les GPO du cache"
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Outils liés à la clé d’accès :"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "Effectuer l'enregistrement de la clé d'accès"
 
@@ -2810,7 +2814,7 @@ msgstr "Version de la stratégie"
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Erreur : Impossible d'obtenir l'objet [%d] : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s : Impossible de lire la valeur [%d] : %s\n"
@@ -2824,99 +2828,99 @@ msgstr "Spécifiez un nom."
 msgid "Unable to parse name %s.\n"
 msgstr "Impossible d'analyser le nom %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Recherche par SID"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Recherche par ID utilisateur"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Date d'expiration initgroups"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Rechercher par ID de groupe"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr "Recherche par GUID de GPO"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Impossible d'analyser la ligne de commande : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr "%s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Impossible d'afficher l'objet : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr "talloc échoué\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr "Impossible d'obtenir la liste d'attributs\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr "Impossible de créer le filtre\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr "%s [%s] :\n"
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr "Impossible d'obtenir le DN de base des GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Impossible de rechercher dans la sysdb : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "Impossible de convertir le message en attributs sysdb : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr "\t%s : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr "Impossible de trouver l'attribut GUID dans l'entrée GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr "Impossible de trouver l'attribut description dans l'entrée GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr "Impossible de supprimer l'entrée GPO du cache\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
@@ -2925,114 +2929,115 @@ msgstr ""
 "Le chemin d'accès à la GPO n'était pas encore stocké en cache. Veuillez "
 "supprimer manuellement les fichiers depuis le répertoire [%s]\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr "Impossible de déterminer le chemin d'accès réel pour [%s] : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
-msgstr "Le chemin d'accès à la GPO en cache [%s] n'est pas sous [%s], ignoré.\n"
+msgstr ""
+"Le chemin d'accès à la GPO en cache [%s] n'est pas sous [%s], ignoré.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Impossible de supprimer les fichiers GPO téléchargés : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Échec de l'ouverture de l'entrée dans le cache : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr "Impossible de déterminer le domaine de l'objet\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr "Impossible de trouver l'attribut GUID dans l'entrée GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Impossible de supprimer la GPO : %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr "%s supprimé du cache\n"
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Afficher les informations de débogage"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "Spécifiez le certificat codé en base64."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "Impossible de se connecter au bus système !\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - aucun utilisateur mappé trouvé -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "Règle de correspondance"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Règle de correspondance"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Impossible d’analyser les arguments de la commande\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Plus de mémoire disponible !\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Échec de la configuration du contexte de la carte de certification.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "Échec de l'ajout de règles de mappage et de correspondance avec l'erreur [%d]"
 "[%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Échec du décodage de la chaîne base64.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Le certificat correspond à la règle.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Le certificat ne correspond pas à la règle.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "Erreur pendant la correspondance des certificats [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "Échec de la génération du filtre de mappage [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -3045,7 +3050,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -3056,35 +3061,35 @@ msgstr ""
 "exemple, si la configuration est définie sur \"/my/path/sssd.conf\", le "
 "répertoire d'extrait \"/my/path/conf.d\" sera utilisé)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "Le fichier %1$s n’existe pas.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "Il n'y a pas de configuration.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Échec de la lecture de '%s' : %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Échec de l'exécution des validateurs"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Problèmes identifiés par les validateurs : %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Messages générés lors de la fusion des configurations : %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Fichiers de configuration utilisés : %zu\n"
@@ -3106,102 +3111,102 @@ msgstr "Impossible d'exporter les substitutions d'utilisateur\n"
 msgid "Unable to export group overrides\n"
 msgstr "Impossible d'exporter les substitutions de groupes\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Remplacer la sauvegarde existante"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Impossible d'importer les substitutions d'utilisateur\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Impossible d'importer les substitutions de groupes\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Démarrer SSSD s'il n'est pas en cours d'exécution"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Redémarrer SSSD après l'importation des données"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Créer des fichiers de cache propres et importer des données locales"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Arrêtez SSSD avant de supprimer le cache"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Démarrer SSSD lorsque le cache est supprimé"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Création d'une sauvegarde des données locales...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "Impossible de créer une sauvegarde des données locales, impossible de "
 "supprimer le cache.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Suppression des fichiers de cache...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Impossible de supprimer les fichiers de cache\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Restauration des données locales...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "Création d'un index de cache pour le domaine %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "Suppression de l'index du cache pour le domaine %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "Index pour le domaine %1$s :\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Attribut : %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Cibler un domaine spécifique"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "domaine"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Attribut à indexer"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "Attribut"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "Action non fournie\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3210,184 +3215,184 @@ msgstr ""
 "Action inconnue : %1$s\n"
 "Les actions valides sont \"%2$s\", \"%3$s et \"%4$s\".\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Attribut (-a) non fourni\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "Attribut %1$s non indexé.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "Attribut %1$s déjà indexé.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "L'opération d'indexation a échoué : %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 "N'oubliez pas de mettre également à jour les index sur les fournisseurs "
 "distants.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 "Afficher la liste des domaines, y compris le type de domaine principal ou de "
 "confiance"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "En ligne"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Hors ligne"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Statut en ligne : %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "Ce domaine n'a pas de serveurs actifs.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Serveurs actifs :\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "non connecté"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Aucun serveur découvert.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "%s serveurs découverts :\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Aucun pour l'instant.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Afficher le statut en ligne"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Afficher les informations sur le serveur actif"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Afficher la liste des serveurs découverts"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Indiquer le nom de domaine."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Impossible d'obtenir le statut en ligne\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Impossible d'obtenir la liste des serveurs\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD ne fonctionne pas.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Domaine inconnu\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Service inaccessible\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Supprimer les fichiers de log au lieu de tronquer"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Suppression des fichiers journaux...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Impossible de supprimer les fichiers journaux\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Troncature des fichiers de journalisation...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Impossible de tronquer les fichiers de journalisation\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Archivage des fichiers journaux dans %s...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Impossible d'archiver les fichiers journaux\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "Ciblez le service SSSD"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "Cibler le service NSS"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "Ciblez le service PAM"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "Ciblez le service SUDO"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "Ciblez le service AUTOFS"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "Ciblez le service SSH"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "Cibler le service PAC"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "Cibler le service IFP"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Spécifiez le niveau de débogage que vous souhaitez définir"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "ERREUR : Prise en charge de l’ID de chaîne Tevent manquante, l’analyseur de "
@@ -3454,19 +3459,19 @@ msgstr ""
 " - shell : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "Action PAM [auth|acct|setc|chau|open|clos], par défaut : "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "Service PAM, par défaut : "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Spécifiez le nom d'utilisateur."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3479,22 +3484,22 @@ msgstr ""
 "service : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "La recherche de nom d'utilisateur avec [%s] a échoué.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "La recherche de l'utilisateur InfoPipe avec [%s] a échoué.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start a échoué : %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3502,12 +3507,12 @@ msgstr ""
 "test de pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item a échoué : %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3516,7 +3521,7 @@ msgstr ""
 "pam_authenticate pour l'utilisateur [%s] : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3524,7 +3529,7 @@ msgstr ""
 "test pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3533,7 +3538,7 @@ msgstr ""
 "pam_chauthtok : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3541,7 +3546,7 @@ msgstr ""
 "test de pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3550,7 +3555,7 @@ msgstr ""
 "pam_acct_mgmt : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3558,7 +3563,7 @@ msgstr ""
 "test de pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3567,7 +3572,7 @@ msgstr ""
 "pam_setcred : [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3575,7 +3580,7 @@ msgstr ""
 "test pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3584,7 +3589,7 @@ msgstr ""
 "pam_open_session : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3592,7 +3597,7 @@ msgstr ""
 "test pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3601,26 +3606,30 @@ msgstr ""
 "pam_close_session : %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "action inconnue\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "Environnement PAM :\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - aucun env -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Définir un fichier de configuration différent de celui par défaut"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Informe que le répondeur a été activé par un socket"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr ""
+#~ "Nombre d'essais pour tenter de se connecter au fournisseur de données"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Désactiver l'interface netlink"
 
diff --git a/po/hu.po b/po/hu.po
index 250d160d082..d0e50995e78 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:45-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Hungarian (http://www.transifex.com/projects/p/sssd/language/"
@@ -48,26 +48,22 @@ msgid "Command to start service"
 msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -75,63 +71,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Elindítandó SSSD szolgáltatások"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -139,1132 +135,1138 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "SSSD által figyelmen kívül hagyott felhasználók"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "SSSD által figyelmen kívül hagyott csoportok"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Hány sikertelen bejelentkezés engedélyezett offline állapotban"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "TLS tanusítvány ellenőrzése"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Azonosító-kiszolgáló"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Legkisebb felhasználói azonosító"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Legnagyobb felhasználói azonosító"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Azonosítók gyorsítótárazása offline használathoz"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Bejegyzés-gyorsítótár érvényessége (másodperc)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA-tartomány"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA kiszolgáló címe"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA kliens hosztneve"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos-kiszolgáló címe"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos-tartomány"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Időtúllépés azonosításkor"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, az LDAP szerver URI-ja"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Alapértelmezett LDAP alap-DN-je"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Az LDAP szerveren használt séma-típus, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Az alapértelmezett bind DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "A kapcsolódási próbálkozás időtartama"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "A CA tanusítványokat tartalmazó fájl"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "TLS tanusítvány ellenőrzése"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1848,32 +1850,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1881,97 +1883,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Elfogyott a memória\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2004,140 +2006,140 @@ msgstr "Hiba lépett fel, de nem érhetőek el részletek."
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Szerver üzenete: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "A jelszavak nem egyeznek"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "A jelszó root általi visszaállítása nem támogatott."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Azonosítva gyorsítótárazott adatbázisból"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", a gyorsítótárazott jelszó lejár ekkor: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr ", a gyorsítótárazott jelszó lejár ekkor: "
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "A hitelesítés megtagadva, amíg: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "A rendszer nem érhető el, a jelszó megváltoztatása nem lehetséges"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "A jelszó megváltoztatása nem sikerült. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Új jelszó: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Jelszó mégegyszer: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Jelszó: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Jelenlegi jelszó: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "A jelszava lejárt, változtass meg most."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2146,7 +2148,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2208,102 +2210,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2337,163 +2343,163 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Nem áll rendelkezésre információ a felhasználóról\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Nem áll rendelkezésre információ a felhasználóról\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2548,7 +2554,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2562,211 +2568,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2775,42 +2781,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2832,284 +2838,284 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA-tartomány"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "GECOS attribútum"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Azonosító-kiszolgáló"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "Az SSSD nem root-ként fut."
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3172,19 +3178,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3193,121 +3199,121 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
diff --git a/po/id.po b/po/id.po
index 6dea1378d8d..3ec9170b157 100644
--- a/po/id.po
+++ b/po/id.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:46-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Indonesian (http://www.transifex.com/projects/p/sssd/language/"
@@ -45,26 +45,22 @@ msgid "Command to start service"
 msgstr "Perintah untuk memulai layanan"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Jumlah usaha yang dilakukan untuk mencoba koneksi ke Penyedia Data"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -72,63 +68,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Layanan SSSD akan dijalankan"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Domain SSSD akan dijalankan"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -136,1132 +132,1138 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Pengguna yang diabaikan secara eksplisit oleh SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Grup yang diabaikan secara eksplisit oleh SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Haruskah pengguna yang disaring muncul dalam grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Nilai kolom kata sandi yang harus dikembalikan oleh penyedia NSS"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Membutuhkan verifikasi sertifikat TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Penyedia identitas"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Penyedia otentikasi"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Penyedia kontrol akses"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Penyedia pengubah kata sandi"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "ID pengguna minimum"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "ID pengguna maksimum"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Domain IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Alamat server IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Nama host klien IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Alamat server Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Realm Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, URI server LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Jenis Skema yang digunakan pada server LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Lamanya waktu untuk mencoba koneksi"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Lamanya waktu untuk mencoba operasi LDAP yang sinkron"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Lamanya waktu antara upaya untuk menyambung kembali saat luring"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Membutuhkan verifikasi sertifikat TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Tentukan mekanisme sasl yang digunakan"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Tentukan id otorisasi sasl yang digunakan"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Keytab layanan Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Gunakan otentikasi Kerberos untuk koneksi LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1845,32 +1847,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1878,97 +1880,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Kehabisan memori\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2000,140 +2002,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Pesan server:"
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Kata sandi tidak cocok"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "Perubahan kata sandi gagal."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Sistem sedang luring, perubahan kata sandi tidak dimungkinkan"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Perubahan kata sandi gagal."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Kata Sandi Baru: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Masukkan lagi kata sandi baru:"
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Kata sandi:"
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Kata sandi saat ini:"
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2142,7 +2144,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2204,102 +2206,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2333,163 +2339,163 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Tidak bisa mendapatkan info tentang pengguna\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Tidak bisa mendapatkan info tentang pengguna\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2544,7 +2550,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2558,211 +2564,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2771,42 +2777,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2828,283 +2834,283 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "Domain IPA"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "Atribut UID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Penyedia otentikasi"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3167,19 +3173,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3188,124 +3194,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Jumlah usaha yang dilakukan untuk mencoba koneksi ke Penyedia Data"
+
 #~ msgid "The UID of the user"
 #~ msgstr "UID dari pengguna"
 
diff --git a/po/it.po b/po/it.po
index 74ba3767914..8401218cdae 100644
--- a/po/it.po
+++ b/po/it.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2020-09-15 08:29+0000\n"
 "Last-Translator: Milo Casagrande <milo@milo.name>\n"
 "Language-Team: Italian <https://translate.fedoraproject.org/projects/sssd/"
@@ -47,30 +47,26 @@ msgid "Command to start service"
 msgstr "Comando per avviare il servizio"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Numero di tentativi di connessione ai provider dati"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "Il numero di descrittori file che possono essere aperti da questo responder"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 #, fuzzy
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 "Tempo di attesa prima di interrompere automaticamente una connessione client"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 #, fuzzy
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Tempo di attesa prima di chiudere automaticamente il responder"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "Interrogare tutte le cache prima dei provider dati"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -78,63 +74,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Servizi SSSD da avviare"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Domini SSSD da avviare"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Espressione regolare per leggere nome utente e dominio"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Formato compatibile con printf per la visualizzazione di nomi completi"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr "Directory dove salvare file di cache delle risposte Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Regola il controllo del certificato"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -142,135 +138,135 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 #, fuzzy
 msgid "Tune passkey verification behavior"
 msgstr "Regola il controllo del certificato"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Durata timeout aggiornamento cache in background (secondi)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Durata timeout negative cache (secondi)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Utenti che SSSD dovrebbe ignorare esplicitamente"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Gruppi che SSSD dovrebbe ignorare esplicitamente"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Indica se mostrare gli utenti filtrati nei gruppi"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 "Il valore del campo password che deve essere ritornato dal provider NSS"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr "Per quanto tempo accettare login in cache tra login online (giorni)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Numero di tentativi di login falliti quando offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -278,1008 +274,1014 @@ msgstr ""
 "Per quanto tempo (minuti) negare i tentativi di login dopo che "
 "offline_failed_login_attemps è stato raggiunto"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Regola il controllo del certificato"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Provider di identità"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Provider di autenticazione"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Provider di access control"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Provider di cambio password"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "Abilita la validazione delle credenziali"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "ID utente minimo"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "ID utente massimo"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Consentire l'enumerazione di tutti gli utenti/gruppi"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Salvare in cache le credenziali per login offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Mostrare utenti/gruppi in formato fully-qualified"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Durata timeout elementi in cache (secondi)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Restringere o preferire una specifica famiglia di indirizzi per l'esecuzione "
 "di lookup DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Per quanto tempo tenere in cache gli elementi dopo un login che ha avuto "
 "successo (giorni)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr "Il tempo di attesa per le richieste DNS (secondi)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "L'interfaccia il cui indirizzo IP dovrebbe essere usato per aggiornamenti "
 "DNS dinamici."
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Dominio IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Indirizzo del server IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Hostname del client IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Filtro LDAP per determinare i privilegi di accesso"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Indirizzo del server Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Realm Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Timeout di autenticazione"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Directory in cui salvare le credenziali"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Percorso della cache delle credenziali utente"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Percorso del keytab per la validazione delle credenziali"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Abilita la validazione delle credenziali"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Intervallo di tempo tra due controlli di rinnovo"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Abilita FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Server dove viene eseguito il servizio di cambio password, se non nel KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, l'indirizzo del server LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Il base DN predefinito"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Lo Schema Type utilizzato dal server LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Il bind DN predefinito"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Il tipo di token di autenticazione del bind DN predefinito"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Il token di autenticazione del bind DN predefinito"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Durata del tentativo di connessione"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Durata del tentativo di esecuzione di operazioni LDAP sincrone"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Durata tra tentativi di riconnessione quando offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Usare solo maiuscole per i nomi dei realm"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "File contenente i certificati CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Percorso della directory dei cerficati della CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "File contenente il certificato client"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "File contenente la chiave client"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Lista delle possibili cipher suite"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Richiedere la verifica del certificato TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Specificare il meccanismo sasl da usare"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Specificare l'id di autorizzazione sasl da usare"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Keytab del servizio Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Usare autorizzazione Kerberos per la connessione LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Seguire i referral LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Metodo di deferenziazione degli alias"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Durata attesa per le richieste di ricerca"
@@ -1865,32 +1867,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Esegui come demone (default)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Esegui interattivamente (non come demone)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1898,97 +1900,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Memoria esaurita\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Un descrittore di file aperto per l'output di debug"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Dominio del provider di informazioni (obbligatorio)"
 
@@ -2022,140 +2024,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Messaggio del server:"
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Le password non coincidono"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Autenticato con le credenziali nella cache"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", la password in cache scadrà il: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr ", la password in cache scadrà il: "
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "L'autenticazione verrà negata fino al: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Il sistema è offline, non è possibile richiedere un cambio password"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Cambio password fallito."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nuova password: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Conferma nuova password: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Password: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Password corrente: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Password scaduta. Cambiare la password ora."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Il livello di debug da utilizzare"
 
@@ -2164,7 +2166,7 @@ msgstr "Il livello di debug da utilizzare"
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Errore di impostazione del locale\n"
 
@@ -2226,102 +2228,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2355,163 +2361,163 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Impossibile determinare le informazioni dell'utente\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Impossibile determinare le informazioni dell'utente\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2566,7 +2572,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2580,211 +2586,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2793,42 +2799,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2850,284 +2856,284 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "Dominio IPA"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "Attributo UID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Provider di autenticazione"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "SSSD non è eseguito da root."
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3190,19 +3196,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3211,124 +3217,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Specificare un file di configurazione specifico"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Numero di tentativi di connessione ai provider dati"
+
 #~ msgid "Privileged socket has wrong ownership or permissions."
 #~ msgstr "Il socket privilegiato ha permessi o propritario non validi."
 
diff --git a/po/ja.po b/po/ja.po
index da19cfa947c..31acd0fd4c2 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2023-06-10 12:20+0000\n"
 "Last-Translator: Ludek Janda <ljanda@redhat.com>\n"
 "Language-Team: Japanese <https://translate.fedoraproject.org/projects/sssd/"
@@ -52,27 +52,23 @@ msgid "Command to start service"
 msgstr "サービス開始のコマンド"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "データプロバイダーの接続を試行する回数"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "このレスポンダーににより開かれるファイル記述子の数"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "クライアントの自動切断までのアイドル時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "レスポンダーの自動シャットダウンまでのアイドル時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 "データプロバイダーをクエリーする前に、常にすべてのキャッシュをクエリーします"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -83,23 +79,23 @@ msgstr ""
 "切断の時間に基づいて長くなります。この値は秒単位で、offline_timeout + "
 "random_offset で計算されます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "開始する SSSD サービス"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "開始する SSSD ドメイン"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "ユーザー名とドメインを構文解析する正規表現"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "完全修飾名を表示するための printf 互換の形式"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -107,36 +103,36 @@ msgstr ""
 "SSSD が Kerberos リプレイキャッシュファイルを保存するファイルシステムのディレ"
 "クトリーです。"
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "domain 要素なしで追加するドメインの名前。"
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "ユーザーが特権を停止します"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "証明書検証の調整"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "グループ名またはユーザー名のすべてのスペースは、この文字に置き換えられます"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "SSSD を調整し、netlink の状態変更を尊重するか、または無視します"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "暗黙のファイルドメインを有効化または無効化する"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "検索するドメインの特定の順番"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -144,7 +140,7 @@ msgstr ""
 "内部 DNS リゾルバーを更新する必要があるときを判断するために SSSD が resolv."
 "conf の状態を監視するかどうかを制御します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -156,76 +152,76 @@ msgstr ""
 "inotify が使用できない場合は、5 秒ごとに resolv.conf のポーリングにフォール"
 "バックします。"
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "AD および IPA プロバイダーに対して PAC レスポンダーを自動的に実行する"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "すべての SSSD プロセスのコアダンプを有効または無効にします。"
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "パスキー検証の動作をチューニングする"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "列挙キャッシュのタイムアウト (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "エントリーキャッシュのバックグラウンド更新のタイムアウト時間 (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "ネガティブキャッシュのタイムアウト (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "ファイルネガティブキャッシュのタイムアウト時間 (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "SSSD が明示的に無視するユーザー"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "SSSD が明示的に無視するグループ"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "フィルターされたユーザーをグループに表示する"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "NSS プロバイダーが返すパスワード項目の値"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr "識別プロバイダーからのホームディレクトリーの値をこの値で上書きする"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "アイデンティティープロバイダーからの空のホームディレクトリーをこの値で置き換"
 "えます"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "アイデンティティープロバイダーからのシェル値をこの値で上書きします"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "ユーザーがログインを許可されるシェルの一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "拒否されてフォールバックシェルで置き換えられるシェルの一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -233,15 +229,15 @@ msgstr ""
 "中央ディレクトリーに保存されたシェルが許可されるが、利用できない場合、この"
 "フォールバックを使用する"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "プロバイダーが一覧に持っていないとき使用するシェル"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "メモリー内のキャッシュレコードが有効な期間"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -249,7 +245,7 @@ msgstr ""
 "パスワード要求の高速インメモリーキャッシュ内で割り当てられるデータテーブルの"
 "サイズ (メガバイト)"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -257,7 +253,7 @@ msgstr ""
 "グループ要求の高速インメモリーキャッシュ内で割り当てられるデータテーブルのサ"
 "イズ (メガバイト)"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -265,7 +261,7 @@ msgstr ""
 "initgroups 要求の高速インメモリーキャッシュ内で割り当てられるデータテーブルの"
 "サイズ (メガバイト)"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -273,13 +269,13 @@ msgstr ""
 "このオプションの値は、テンプレートに書式文字列 %H を含んでいる場合に "
 "override_homedir オプションの拡張で使用されます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr "サブドメインのリストが有効とみなされる時間を秒単位で指定します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -289,98 +285,98 @@ msgstr ""
 "リクエストが行われた場合に、バックグラウンドでエントリーを自動的に更新するよ"
 "うに設定できます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr "オンラインログイン中にキャッシュによるログインが許容される期間 (日数)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "オフラインの時に許容されるログイン試行失敗回数"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr "offline_failed_login_attempts に達した後にログインを拒否する時間 (分)"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "認証中にユーザーに表示されるメッセージの種類"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "pam_sss へ送信された PAM のレスポンスをフィルタリングします"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr "PAM 要求に対してキャッシュされた認証情報を保持する秒数"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "警告が表示されるパスワード失効前の日数"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "信頼できる UID またはユーザー名の一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "信頼できないユーザーでさえアクセス可能なドメインの一覧。"
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "ユーザーアカウントの有効期限が切れると、メッセージが印刷されます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "ユーザーアカウントがロックされると、メッセージが印刷されます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "証明書ベースまたはスマートカードによる認証を許可します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "PKCS#11 モジュールでの証明書データベースへのパス。"
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "PAM 認証の証明書検証の調整。"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "p11_child が完了するまでに pam_sss が待つ秒数"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr "アプリケーションドメインへの接続を許可される PAM サービスはどれか"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "スマートカードの使用が許可されたサービス"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "要求された場合に、カードが待つ追加のタイムアウト"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr "スマートカード認証向けのデバイスの選択を PKCS#11 URI が制限"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "PAM レスポンダーが initgroups リクエストを強制するとき"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "GSSAPI での認証が許可される PAM サービスの一覧。"
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "ターゲットユーザーと認証された UPN に一致するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -388,27 +384,27 @@ msgstr ""
 "GSSAPI 認証で PAM アクセスを強制する必要があるペア <PAM service>:"
 "<authentication indicator> のリスト"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "パスキーデバイス認証を許可します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "pam_sss が passkey_child の終了を待機する秒数"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "lifido2 ライブラリーでデバッグを有効にする"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "sudo ルールにおいて時間による属性を評価するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "正しい場合、SSSD は小さい番号が優先される順位付けのロジックへ戻ります"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -416,48 +412,48 @@ msgstr ""
 "一度にリフレッシュ可能なルールの最大数。最大数を超えると、フルリフレッシュが"
 "実行されます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "known_hosts ファイルにおいてホスト名とアドレスをハッシュ化するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr "ホスト鍵が要求された後 known_hosts ファイルにホストを保持する秒数"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "信頼された CA 証明書のストレージへのパス"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "証明書からの ssh-key の生成を許可します"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 "以下の一致するルールを使用して、ssh-key 生成用の証明書をフィルタリングします"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr "PAC レスポンダーへのアクセスが許可された UID またはユーザー名の一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "PAC データが有効とされる期間"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "PAC を検証する"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "InfoPipe がパブリッシュを許可されたユーザー属性の一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -467,7 +463,7 @@ msgstr ""
 "いません。some: ユーザーとグループオプションによって指定されているユーザー/グ"
 "ループが記録されています。all: すべてのユーザーが記録されます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -477,7 +473,7 @@ msgstr ""
 "返すユーザー名にマッチします。つまり、スペースの置換、大文字小文字の変更など"
 "の可能性がある場合には、その後になります。"
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -487,13 +483,13 @@ msgstr ""
 "トです。NSS が返すグループ名にマッチします。つまり、スペースの置換、大文字小"
 "文字の変更などの可能性がある場合には、その後になります。"
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr "録画から除外されるユーザーのコンマ区切りリスト。scope=all の場合のみ"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -501,99 +497,99 @@ msgstr ""
 "scope=all の場合にのみ記録から除外されるべきメンバーから成るグループのコンマ"
 "区切りリスト。 "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "アイデンティティープロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "認証プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "アクセス制御プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "パスワード変更プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "ホスト識別プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "SELinux プロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "セッションマネージャーのプロバイダー"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "リゾルバープロバイダ"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "OS またはアプリケーションがドメインを使用できるかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "ドメインを有効または無効にする"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "最小ユーザー ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "最大ユーザー ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "すべてのユーザー・グループの列挙を有効にする"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "オフラインログインのためにクレデンシャルをキャッシュする"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "ユーザー・グループを完全修飾形式で表示する"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "グループ検索にグループメンバーを含めない"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "エントリーキャッシュのタイムアウト長 (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr "DNS 検索を実行する時に特定のアドレスファミリーを制限または優先します"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr "最終ログイン成功時からキャッシュエントリーを保持する日数"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -601,118 +597,118 @@ msgstr ""
 "次のサーバーを試行するまでに SSSD が単一の DNS サーバーと通信する時間 (ミリ"
 "秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "単一の DNS クエリーの解決を試行する時間 (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr "サーバーを名前解決する時に DNS から応答を待つ時間 (秒)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "サービス検索 DNS クエリーのドメイン部分"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "識別プロバイダーからの GID 値をこの値で上書きする"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "ユーザー名が大文字小文字を区別するよう取り扱う"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "期限切れのエントリーがバックグラウンドで更新される頻度"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr "バックグラウンドで期限切れのエントリーを更新するときの最大期間の逸脱"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "自動的にクライアントの DNS エントリーを更新するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "クライアントの DNS 項目を更新後、適用する TTL"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "動的 DNS 更新のために使用される IP のインターフェース"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "どのくらい定期的にクライアントの DNS エントリーを更新するか"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "クライアントの DNS エントリーを更新するときの最大期間の逸脱"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 "プロバイダーが同じように PTR レコードを明示的に更新する必要があるかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "nsupdate ユーティリティーが標準で TCP を使用するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr "DNS 更新を実行するために使用すべき認証の種類"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "DNS の更新を実行する際に使用する DNS サーバーを上書き"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "信頼されたドメインの列挙を制御"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "サブドメインの一覧のリフレッシュ回数"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "サブドメインリストを更新するときの最大期間の逸脱"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "サブドメインに継承すべきオプションの一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "デフォルトのサブドメインホームディレクトリーの値"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr "証明書キャッシュを認証キャッシュに使用できる期間"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "ユーザーにプライベートグループを自動的に作成するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "パスワードの期限が切れる N 日前の警告を表示します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr "このドメインのための realmd 設定サービスによって格納された様々なタグ。"
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -720,7 +716,7 @@ msgstr ""
 "サブドメインの取得を処理する必要のあるプロバイダー。この値は常に id_provider "
 "と同じでなければなりません。"
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -728,7 +724,7 @@ msgstr ""
 "リフレッシュ後にホストの ssh 鍵を保持するには何秒かかるか。IE ホストキーを何"
 "秒キャッシュするか。"
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -738,99 +734,99 @@ msgstr ""
 "この値は、最初の認証要素 (長期パスワード) を SHA512 ハッシュとしてキャッシュ"
 "に保存する必要がある最小の長さを決定します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA ドメイン"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA サーバーのアドレス"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "バックアップ IPA サーバーのアドレス"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA クライアントのホスト名"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "FreeIPA にあるクライアントの DNS エントリーを自動的に更新するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "HBAC 関連オブジェクトの検索ベース"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "IPA サーバーに対する HBAC ルールを検索している間の合計時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr "IPA サーバーに対する SELinux マップの検索の間の秒単位の合計時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr "もし偽に設定されていると、PAM により渡されたホスト引数は無視されます"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "この IPA クライアントが使用している automounter の場所"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "IPA ドメインに関する情報を含むオブジェクトに対する検索ベース"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "ID 範囲に関する情報を含むオブジェクトに対する検索ベース"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "DNS サイトの有効化 - 位置ベースのサービス検索"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "ビューコンテナーの検索ベース"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "ビューコンテナーのオブジェクトクラス"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "ビューの名前の属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "上書きされたオブジェクトのオブジェクトクラス"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "オリジナルオブジェクトを参照する属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "ユーザーが上書きするオブジェクトのオブジェクトクラス"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "グループが上書きするオブジェクトのオブジェクトクラス"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "デスクトッププロファイルに関連するオブジェクトの検索ベース"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -838,7 +834,7 @@ msgstr ""
 "IPA サーバーに対するデスクトッププロファイルルールを検索している間の秒単位の"
 "合計時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -846,41 +842,41 @@ msgstr ""
 "最後の要求がルールを何も見つけなかった場合の IPA サーバーに対するデスクトップ"
 "プロファイルルールを検索している間の分単位の合計時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "SUBID 範囲の検索ベース"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "どのルールがアクセス制御を評価するために使用されるか"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "ホストの FQDN を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "LDAP にあるホストエントリーのオブジェクトクラスです。"
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "ホストオブジェクトの検索ベースとして与えられた文字列を使用します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "ホストの SSH 公開鍵を含む LDAP 属性です。"
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "ネットグループの NIS ドメイン名を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "ネットグループのメンバーの名前を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -888,7 +884,7 @@ msgstr ""
 "ネットグループのメンバーであるホストとホストグループの FQDN を一覧表示する "
 "LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -896,11 +892,11 @@ msgstr ""
 "ネットグループの直接のメンバーであるホストとホストグループを一覧表示する "
 "LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "ネットグループのメンバーシップを一覧表示する LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -908,45 +904,45 @@ msgstr ""
 "ネットグループの直接のメンバーであるシステムユーザーとグループを一覧表示する "
 "LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "ネットワークグループ名に対応する LDAP 属性です。"
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "LDAP にあるネットワークグループエントリーのオブジェクトクラスです。"
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "LDAP ネットグループオブジェクトの UUID/GUID を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr "使用のためにユーザーマップが有効になっているかどうかを含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "'all' などのホストカテゴリを含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr "このルールがマッチするすべてのホスト/ホストグループを含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr "このルールがマッチするすべてのユーザー/グループを含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "SELinux usermap の名前を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -954,19 +950,19 @@ msgstr ""
 "memberUser および memberHost の代わりにマッチングに使用できる HBAC ルールの "
 "DN を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "SELinuxのユーザー文字列そのものを含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "'all' などのユーザーカテゴリーを含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "ユーザーマップの一意の ID を含む LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -975,58 +971,58 @@ msgstr ""
 "からのユーザーとグループの検索を異なる方法で実行する必要があることを示しま"
 "す。"
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 "信頼されたドメインに対する検索ベースとして、与えられた文字列を使用します。"
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active Directory ドメイン"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "有効化された Active Directory ドメイン"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Active Directory サーバーアドレス"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Active Directory バックアップサーバーのアドレス"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Active Directory クライアントホスト名"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "アクセス権限を決めるための LDAP フィルター"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "検索にグローバルカタログを使用するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "グローバルカタログベースのアクセス制御に対するオペレーションモード"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "AD サーバーに対する GPO ポリシーファイルを検索している間の合計時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 "GPO (Deny)InteractiveLogonRight のポリシー設定にマッピングした PAM サービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1034,282 +1030,282 @@ msgstr ""
 "GPO (Deny)RemoteInteractiveLogonRight のポリシー設定にマッピングした PAM サー"
 "ビス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "GPO (Deny)NetworkLogonRight のポリシー設定にマッピングした PAM サービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "GPO (Deny)BatchLogonRight のポリシー設定にマッピングした PAM サービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr "(Deny)ServiceLogonRight のポリシー設定にマッピングした PAM サービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "GPO ベースのアクセスが常に許可される PAM サービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "GPO ベースのアクセスが常に拒否される PAM サービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "マッピングされていない PAM サービス名に使用するデフォルトのログオン権利 (また"
 "は許可/拒否)"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "クライアントが使用する特定のサイト"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr "マシンアカウントのパスワードの更新が必要となるまでの最大日数"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "マシンアカウントの更新タスクをチューニングするオプション"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr "Samba データベースのマシンアカウントパスワードを更新するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "LDAP およびグローバルカタログのリクエストに LDAPS ポートを使用する"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "他のドメインからのドメインローカルグループをフィルターしない"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos サーバーのアドレス"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Kerberos バックアップサーバーのアドレス"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos レルム"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "認証のタイムアウト"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "kdcinfo ファイルを作成するかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "krb5 設定スニペットを削除する場所"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "クレデンシャルのキャッシュを保存するディレクトリー"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "ユーザーのクレデンシャルキャッシュの位置"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "クレデンシャルを検証するキーテーブルの場所"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "クレデンシャルの検証を有効にする"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "後からオンライン認証するためにオフラインの場合にパスワードを保存します"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "更新可能な TGT の有効期間"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "TGT の有効期間"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "更新を確認する間隔"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "FAST を有効にする"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "FAST に使用するプリンシパルを選択する"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "匿名の PKINIT を使用して FAST の認証情報を要求する"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "プリンシパル正規化を有効にする"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "エンタープライズ・プリンシパルの有効化"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "認証にサブドメインレルムの使用を有効化"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "ユーザー名から Kerberos プリンシパル名までのマッピング"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "KDC になければ、パスワード変更サービスが実行されているサーバー"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, LDAP サーバーの URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, LDAP サーバーの URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "デフォルトのベース DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "LDAP サーバーにおいて使用中のスキーマ形式、rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "ユーザーのパスワードの変更にモードを使用しました"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "デフォルトのバインド DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "デフォルトのバインド DN の認証トークンの種類"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "デフォルトのバインド DN の認証トークン"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "接続を試行する時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "LDAP 同期操作を試行する時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "オフラインの間に再接続を試行する時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "レルム名に対して大文字のみを使用する"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "CA 証明書を含むファイル"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "CA 証明書のディレクトリーのパス"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "クライアント証明書を含むファイル"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "クライアントの鍵を含むファイル"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "利用可能な暗号の一覧"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "TLS 証明書の検証を要求する"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "使用する SASL メカニズムを指定する"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "使用する SASL 認可 ID を指定する"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "使用する SASL 認可レルムを指定する"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "LDAP SASL 認可の最小 SSF を指定する"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "LDAP SASL 認可の最大 SSF を指定する"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Kerberos サービスのキーテーブル"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "LDAP 接続に対して Kerberos 認証を使用する"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "LDAP リフェラルにしたがう"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "LDAP 接続の TGT の有効期間"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "エイリアスを参照解決する方法"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "DNS サービス検索のサービス名"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "単一の LDAP クエリーにおいて取得するレコード数"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr "完全な参照解決を引き起こすために欠けている必要があるメンバーの数"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "読むことのできない LDAP 参照を無視する"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1317,7 +1313,7 @@ msgstr ""
 "LDAP ライブラリーが SASL バインド中にホスト名を正規化するために逆引きを実行す"
 "るかどうか"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1325,30 +1321,36 @@ msgstr ""
 "RFC2307 スキーマを使用するサーバーの LDAP グループのメンバーとしてローカル"
 "ユーザーを保持することができます。"
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN 属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN 属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "LDAP サーバーを切断する前に接続を保持する時間"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "LDAP ページング制御を無効化する"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Active Directory 範囲の取得の無効化"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "検索要求を待つ時間"
@@ -1942,33 +1944,33 @@ msgstr "passwd ファイルソースへのパス。"
 msgid "Path of group file sources."
 msgstr "グループファイルソースへのパス。"
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "インデックス操作に失敗しました: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "デーモンとして実行 (デフォルト)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "対話的に実行 (デーモンではない)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "バージョン番号を表示して終了する"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -1976,97 +1978,97 @@ msgid ""
 "\n"
 msgstr "インデックス操作に失敗しました: %1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "Option -i|--interactive iは、 -D|--daemon とは使用できません\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "メモリー不足\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "コアダンプの許可"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "デバッグログのオープンファイルディスクリプター"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "次のように FAST ccache を作成するユーザー"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "次のように FAST ccache を作成するグループ"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "匿名の PKINIT を使用して FAST の armo チケットを要求する"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "使用する Kerberos レルム"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "チケットの要求された有効期間"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "チケットの要求された更新可能な有効期間"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "FAST のオプション ('never'、'try'、'demand')"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "FAST で使用するサーバープリンシパルを指定します"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "プリンシパル名の正規化を要求します"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "krb5_get_init_creds_password のカスタムバージョンを使用します"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "デバッグのロギングの冗長性を設定する"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "PAC フラグを確認する"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf は失敗しました。\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd は失敗しました。\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "情報プロバイダーのドメイン (必須)"
 
@@ -2100,65 +2102,65 @@ msgstr "エラーが発生しましたが、説明がありませんでした。
 msgid "Unexpected error while looking for an error description"
 msgstr "エラーの説明を検索中に予期しないエラーが発生しました"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "パーミッションが拒否されました。 "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "サーバーのメッセージ: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "PIN の入力:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "パスワードが一致しません"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "root によるパスワードのリセットはサポートされません。"
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "キャッシュされているクレデンシャルを用いて認証されました"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr "、キャッシュされたパスワードが失効します: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "パスワードの期限が切れています。あと %1$d 回ログインできます。"
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "あなたのパスワードは %1$d %2$s に期限切れになります。"
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "パスワードの有効期限が切れています。"
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "次まで認証が拒否されます: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "システムがオフラインです、パスワード変更ができません"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2166,76 +2168,76 @@ msgstr ""
 "OTP パスワードの変更後、チケットを取得するためにログアウト後に再びログインす"
 "る必要があります"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN がロックされました"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "パスワードの変更に失敗しました。 "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "%1$s で認証し、ENTER を押します。"
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "%2$s で PIN %1$s を使用して認証し、ENTER を押します。"
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "(別の)スマートカードを挿入(し直)してください"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "新しいパスワード: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "新しいパスワードの再入力: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "1 番目の要素: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "2 番目の要素 (オプション): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "2 番目の要素: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "パスキーデバイスを挿入し、ENTER キーを押します。"
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "パスワード: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "1 番目の要素 (現在のパスワード): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "現在のパスワード: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "パスワードの期限が切れました。いますぐパスワードを変更してください。"
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "実行するデバッグレベル"
 
@@ -2244,7 +2246,7 @@ msgstr "実行するデバッグレベル"
 msgid "The SSSD domain to use"
 msgstr "使用する SSSD ドメイン"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "ロケールの設定中にエラーが発生しました\n"
 
@@ -2306,85 +2308,89 @@ msgstr "sss_ssh_knownhostsproxy: ホスト %s ポート %d に接続: %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: ホスト名 %s を解決できませんでした\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "指定された検索に一致するキャッシュオブジェクトがありません\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "%1$s を無効化できませんでした\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "%1$s %2$s を無効化できませんでした\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "すべてのキャッシュエントリーを無効化します"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "特定のユーザーを無効にする"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "すべてのユーザーを無効にする"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "特定のグループを無効にする"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "すべてのグループを無効にする"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "特定のネットワークグループを無効にする"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "すべてのネットワークグループを無効にする"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "特定のサービスの無効化"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "すべてのサービスの無効化"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "特定の autofs マップの無効化"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "すべての autofs マップの無効化"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "特定の SSH ホストを無効化します"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "すべての SSH ホストを無効化します"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "特定の sudo ルールを無効化します"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "すべてのキャッシュ sudo ルールを無効化します"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "特定のドメインのみからエントリーを無効にする"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2392,11 +2398,11 @@ msgstr ""
 "予期しない引数が提供される場合、1 つのオブジェクトを無効化するオプションは、"
 "提供された引数を 1 つだけ受け取ります。\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "無効化するオブジェクトを少なくとも一つ選択してください\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2405,7 +2411,7 @@ msgstr ""
 "ドメイン %1$s を開けませんでした。ドメインがサブドメイン (信頼済みドメイン) "
 "であれば、--domain/-d パラメーターの代わりに完全修飾名を使用してください。\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "利用可能なドメインを開けませんでした\n"
 
@@ -2440,163 +2446,163 @@ msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 "無効なインプットです。'%s' または '%s' のいずれかを提供してください。\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "外部のコマンドを実行中にエラーが発生しました\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "外部コマンド '%s' の実行時のエラー\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "コマンド '%s' が [%d] で失敗しました\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "SSSD を実行する必要があります。SSSD をすぐに実行しますか?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "SSSD を実行してはいけません。SSSD を今、停止しますか?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "SSSD は再起動が必要です。SSSD を今、再起動しますか?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "SSSD ステータス:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "利用可能なドメインを一覧表示します"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "ドメイン情報を出力します"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "ユーザーに関する情報を出力し、認証を確認します"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "ドメインのアクセスレポートを生成します"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "キャッシュされたコンテンツの情報:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "キャッシュされたユーザーの情報"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "キャッシュされたグループの情報"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "キャッシュされた netgroup の情報"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "ローカルデータツール:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "ローカルデータのバックアップ"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "バックアップからローカルデータを復元"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "ローカルデータのバックアップとキャッシュされたコンテンツの削除"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "キャッシュされたオブジェクトの無効化"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "キャッシュインデックスの管理"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "ログファイルツール:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "既存 SSSD ログファイルの削除"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "tarball で SSSD ログファイルをアーカイブ"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "SSSD デバッグレベル情報の変更または出力"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "ログデータの分析"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "設定ファイルツール:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "SSSD 設定の静的分析を実行"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "証明書関連ツール:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "証明書の情報を出力"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "証明書にマッピングされたユーザーの表示"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "証明書によるマッピングおよびマッチングルールの確認"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 #, fuzzy
 msgid "GPOs related tools:"
 msgstr "パスキー関連のツール:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "キャッシュされたユーザーの情報"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "パスキー関連のツール:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "パスキー登録の実行"
 
@@ -2651,7 +2657,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "エラー: オブジェクト [%d] を取得できません: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: 値 [%d] の読み込みができません: %s\n"
@@ -2665,219 +2671,219 @@ msgstr "名前を指定します。"
 msgid "Unable to parse name %s.\n"
 msgstr "名前 %s を構文解析できません。\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "SID で検索"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "ユーザーID で検索"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Initgroups の期限切れ時間"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "グループ ID で検索"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 #, fuzzy
 msgid "Search by GPO guid"
 msgstr "グループ ID で検索"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, fuzzy, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "コマンド引数を解析できません\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, fuzzy, c-format
 msgid "Failed to print object: %s\n"
 msgstr "%s を開くことに失敗しました\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 #, fuzzy
 msgid "talloc failed\n"
 msgstr "malloc は失敗しました。\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 #, fuzzy
 msgid "Unable to get attribute list!\n"
 msgstr "サーバー一覧を取得できません\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "キャッシュファイルを削除できません\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 #, fuzzy
 msgid "Unable to get GPOs base DN\n"
 msgstr "サーバー一覧を取得できません\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, fuzzy, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "ログファイルのアーカイブができません\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, fuzzy, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "システムバスに接続できません。\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, fuzzy, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "ログファイルを削除できません\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, fuzzy, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "%s を開くことに失敗しました\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "利用可能なドメインを開けませんでした\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, fuzzy, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "%s を開くことに失敗しました\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "デバッグ情報の表示"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "base64 でエンコードされた証明書を指定します。"
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "システムバスに接続できません。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - マッピングされたユーザーが見つかりません -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "マッピングルール"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "マッチングルール"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "コマンド引数を解析できません\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "メモリーの空き容量がありません。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "certmap コンテキストの設定に失敗しました。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "エラー [%d][%s] により、マッピングおよびマッチングルールを追加できませんでし"
 "た。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "base64 文字列のデコードに失敗しました。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "証明書はルールと一致します。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "証明書はルールに一致しません。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "証明書照会時のエラー [%d][%s]。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "マッピングフィルターを生成できませんでした [%d][%s]。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2890,7 +2896,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2901,35 +2907,35 @@ msgstr ""
 "path/sssd.conf\" に設定されている場合は、スニペット dir \"/my/path/conf.d\" "
 "が使用されます"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "ファイル %1$s は存在しません。\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "設定はありません。\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, fuzzy, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "%s を開くことに失敗しました\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "バリデーターの実行に失敗しました"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "バリデーターで特定された問題: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "設定のマージ中に生成されたメッセージ: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "使用された設定スニペットファイル: %zu\n"
@@ -2952,102 +2958,102 @@ msgstr "ユーザーの上書きをエクスポートできません\n"
 msgid "Unable to export group overrides\n"
 msgstr "グループの上書きをエクスポートできません\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "既存のバックアップを上書き"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "ユーザーの上書きをインポートできません\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "グループの上書きをインポートできません\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "実行中でない場合、SSSD を開始します"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "データのインポートの後、SSSD を再起動します"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "クリーンなキャッシュファイルを作成し、ローカルデータをインポートします"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "キャッシュを削除する前に SSSD を停止します"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "キャッシュの削除後に SSSD を開始します"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "ローカルデータのバックアップを作成中...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "ローカルデータのバックアップの作成ができません。キャッシュを削除できませ"
 "ん。\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "キャッシュファイルの削除中...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "キャッシュファイルを削除できません\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "ローカルデータの復元中...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "ドメイン %1$s のキャッシュインデックスの作成\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "ドメイン %1$s のキャッシュインデックスの削除\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "ドメイン %1$s のインデックス:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  属性: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "特定ドメインをターゲットに指定"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "ドメイン"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "インデックスの属性"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "属性"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "アクションが指定されていません\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3056,181 +3062,181 @@ msgstr ""
 "不明なアクション: %1$s \n"
 "有効なアクションは %2$s、%3$s、%4$s です\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "属性 (-a) は指定されていません\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "属性 %1$s のインデックスは作成されていません。\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "属性 %1$s のインデックスはすでに作成されています。\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "インデックス操作に失敗しました: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "リモートプロバイダーのインデックスも忘れず更新してください。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 "プライマリーまたは信頼されたドメインタイプを含むドメインリストを表示します"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "オンライン"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "オフライン"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "オンライン状態: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "このドメインには、アクティブなサーバーはありません。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "アクティブサーバー:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "接続していません"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "サーバーが見つかりません。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "%s サーバーが見つかりました:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "今のところありません。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "オンライン状態を表示"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "アクティブサーバーに関する情報の表示"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "見つかったサーバーに関する一覧を表示"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "ドメイン名を指定します。"
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "オンライン状態を取得できません\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "サーバー一覧を取得できません\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD は実行されていません。\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s 不明なドメイン\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s アクセスできないサービス\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "切り捨てる代わりにログファイルを削除します"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "ログファイルを削除中...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "ログファイルを削除できません\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "ログファイルを切り捨てます...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "ログファイルの切り捨てができません\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "ログファイルを %s へアーカイブ中...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "ログファイルのアーカイブができません\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "SSSD サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "NSS サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "PAM サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "SUDO サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "AUTOFS サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "SSH サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "PAC サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "IFP サービスをターゲットに設定"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "設定するデバッグレベルを指定します"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "エラー: Tevent chain ID サポートがなく、ログアナライザーはサポートされませ"
@@ -3297,19 +3303,19 @@ msgstr ""
 " - shell: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "PAM アクション [auth|acct|setc|chau|open|clos]、デフォルト: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "PAM サービス、デフォルト: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "ユーザー名を指定します。"
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3322,22 +3328,22 @@ msgstr ""
 "サービス: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "[%s] でのユーザー名の検索に失敗しました。\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "[%s] での InfoPipe ユーザーの検索に失敗しました。\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start に失敗しました: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3345,12 +3351,12 @@ msgstr ""
 "pam_authenticate のテスト中\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item に失敗しました: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3359,7 +3365,7 @@ msgstr ""
 "ユーザー [%s] 向けの pam_authenticate: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3367,7 +3373,7 @@ msgstr ""
 "pam_chauthtok のテスト中\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3376,7 +3382,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3384,7 +3390,7 @@ msgstr ""
 "pam_acct_mgmt のテスト中\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3393,7 +3399,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3401,7 +3407,7 @@ msgstr ""
 "pam_setcred のテスト中\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3410,7 +3416,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3418,7 +3424,7 @@ msgstr ""
 "pam_open_session のテスト中\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3427,7 +3433,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3435,7 +3441,7 @@ msgstr ""
 "pam_close_session のテスト中\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3444,26 +3450,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "不明なアクション\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "PAM 環境:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - no env -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "非標準の設定ファイルの指定"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "レスポンダーがソケットでアクティベートされたと知らせます"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "データプロバイダーの接続を試行する回数"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "netlink インターフェースを無効にする"
 
diff --git a/po/ka.po b/po/ka.po
index efaf109065d..11d35309a21 100644
--- a/po/ka.po
+++ b/po/ka.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-06-19 04:36+0000\n"
 "Last-Translator: Temuri Doghonadze <temuri.doghonadze@gmail.com>\n"
 "Language-Team: Georgian <https://translate.fedoraproject.org/projects/sssd/"
@@ -45,26 +45,22 @@ msgid "Command to start service"
 msgstr "სერვისის გასაშვები ბრძანება"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -72,63 +68,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD -ის გასაშვები სერვისები"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD -ის გასაშვები დომენები"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -136,1131 +132,1137 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "იდენტიფიკაციის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "ავთენტიკაციის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "წვდომის კონტროლის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "პაროლის შეცვლის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO -ის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs -ის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "ჰოსტის იდენტიფიკაციის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "SELinux -ის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "სესიის მართვის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "ამომხსნელის მომწოდებელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "დომენის ჩართვა ან გამორთვა"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "მომხმარებლის მინიმალური ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "მომხმარებლის მაქსიმალური ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA დომენი"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA სერვერის მისამართი"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA კლიენტის ჰოსტის სახელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active Directory-ის დომენი"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Active Directory-ის ჩართული დომენები"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Active Directory -ის სერვერის მისამართი"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Active Directory -ის მარქაფი სერვერის მისამართი"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Active Directory -ის კლიენტის ჰოსტის სახელი"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos-ის რეალმი"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN ატრიბუტი"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN ატრიბუტი"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1844,32 +1846,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1880,97 +1882,97 @@ msgstr ""
 "არასწორი პარამეტრი %s:%s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "მეხსიერება გადახარჯულია\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf ჩავარდა.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2002,140 +2004,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "წვდომა აკრძალულია. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "პაროლები არ ემთხვევა"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "თქვენს პაროლს ვადა გაუვიდა."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "პაროლის შეცვლის შეცდომა. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "ახალი პაროლი: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "პაროლი: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "მიმდინარე პაროლი: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2144,7 +2146,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2206,102 +2208,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2335,161 +2341,161 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2543,7 +2549,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2557,211 +2563,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "ბრძანების სტრიქონის დამუშავების შეცდომა: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "ობიექტის დაბეჭდვა ჩავარდა: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr "talloc ჩავარდა\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr "ფილტრის შექმნა ჩავარდა\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "ჩავარდა ძებნა sysdb-ში: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "კეშის ჩანაწერის გამოთხოვა ჩავარდა: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "GPO-ის წაშლა ჩავარდა: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "წესი, რომელიც ემთხვევა"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "ბრძანების პარამეტრების დამუშავების შეცდომა\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "არასაკმარისი მეხსიერება!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Base64 სტრიქონის გაშიფვრის შეცდომა.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2770,42 +2776,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "ფაილი %1$s არ არსებობს.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "%s-ის გახსნა ჩავარდა: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2827,280 +2833,280 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "დომენი"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "ატრიბუტი"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "ონლაინ"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "გათიშული"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "არაა დაკავშირებული"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3163,19 +3169,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3184,120 +3190,120 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start ჩავარდა: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item ჩავარდა: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "უცნობი ქმედება\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
diff --git a/po/ko.po b/po/ko.po
index 649cda7a3ce..661a4641713 100644
--- a/po/ko.po
+++ b/po/ko.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-06-12 15:36+0000\n"
 "Last-Translator: 김인수 <simmon@nplob.com>\n"
 "Language-Team: Korean <https://translate.fedoraproject.org/projects/sssd/"
@@ -48,26 +48,22 @@ msgid "Command to start service"
 msgstr "서비스 시작 명령"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "자료(데이타) 공급자에 대한 연결 시도 횟수"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "이 응답자에 의해 열 수 있는 파일 설명자 수"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "클라이언트의 자동 연결 해제 전 유휴 시간"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "응답자의 자동 종료 전 유휴 시간"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "자료 공급자를 질의(쿼리)하기 전에 항상 모든 캐쉬를 질의합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -78,23 +74,23 @@ msgstr ""
 "기 전에 시간이 늘어납니다. 이 값은 초 단위이며 다음에 의해 계산됩니다: "
 "offline_timeout + random_offset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "시작 하려는 SSD 서비스"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "시작하려는 SSSD 도메인"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "사용자 이름과 도메인을 구문 분석하는 정규식"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "완전히-인증된 이름을 표시하기 위한 출력-호환 형식"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -102,35 +98,35 @@ msgstr ""
 "SSSD가 커버러스(Kerberos) 재생 캐쉬 파일을 저장해야 하는 파일 시스템의 디렉토"
 "리."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "도메인 구성 요소가 없는 명칭이 추가되는 도메인."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "사용자의 권한을 제거하는"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "인증 확인을 조정합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr "그룹과 사용자 이름에서 모든 공간은 이와 같은 문자로 대체 될 것입니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "sssd를 netlink 상태 변경을 존중하거나 무시하도록 조정합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "절대적인 파일 도메인을 활성화 또는 비활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "조회 할 도메인의 특정 순서"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -138,7 +134,7 @@ msgstr ""
 "SSSD가 내부 DNS resolver를 최신화해야 하는 시기를 식별하기 위해 resolv.conf"
 "의 상태를 모니터링 해야 하는지 여부를 제어합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -150,74 +146,74 @@ msgstr ""
 "고, 만약 inotify를 사용 할 수 없는 경우에 매 5초마다 resolv.conf 투표로 되돌"
 "아 갈 것입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "AD와 IPA 공급자를 위해 자동으로 PAC 응답자 실행"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "SSSD 프로세서를 위한 코어 덤프 활성화 또는 비활성화."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "패스키 확인 동작을 조정합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "열거된 캐쉬 시간 초과 길이(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "항목 캐쉬 백그라운드 최신화 시간 초과 길이(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "네거티브 캐쉬 시간 초과 길이(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "파일 네거티브 캐쉬 시간 초과 길이(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "SSSD가 명시적으로 무시해야 하는 사용자"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "SSSD가 명시적으로 무시해야 하는 그룹"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "그룹에서 필터링된 사용자가 표시되어야 합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "NSS 공급자가 반환해야 하는 비밀번호 입력 값"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr "이 값으로 식별 공급자에서 homedir 값을 재정의합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr "이 값과 함께 식별 공급자에서 빈 homedir 값을 이 값으로 대체합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "이 값과 함께 식별 공급자에서 쉘 값을 재정의 합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "사용자가 접속할 수 있는 shells 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "거부되어서 대체될 쉘 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -225,35 +221,35 @@ msgstr ""
 "중앙 디렉토리에 저장된 쉘이 허용되지만 사용할 수 없는 경우 이 대체를 사용하십"
 "시오"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "공급자가 목록을 나열하지 않는 경우 사용할 쉘"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "캐쉬 메모리에 기록의 유효 기간"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr "비밀번호 요청을 위해 빠른 캐쉬 메모리에 할당된 자료 테이블의 크기(MB)"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 "그룹 요청을 위한 고속 캐쉬 메모리에 내부에 할당된자료 테이블의 크기(MB)"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 "initgroups 요청을 위해 빠른 캐쉬 메모리에 할당된 자료 테이블의 크기(MB)"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -261,13 +257,13 @@ msgstr ""
 "템플릿에 형식 문자열 %H가 포함된 경우 이 옵션의 값은 override_homedir 옵션의 "
 "확장에 사용됩니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr "하위 도메인 목록이 유효한 것으로 간주되는 시간(초) 지정합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -276,99 +272,99 @@ msgstr ""
 "항목 캐쉬는 도메인에 대한 entry_cache_timeout 값의 백분율을 초과하여 요청되"
 "는 경우 백그라운드에서 항목을 자동으로 최신화 하도록 설정 할 수 있습니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr "온라인 접속과 캐쉬 사이의 접속을 허용하는 기간(일)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "오프라인일 때 허용되는 접속 시도 실패 횟수"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 "offline_failed_login_attempts에 도달한 후 접속을 거부하는 데 걸리는 시간(분)"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "인증 시 사용자에게 표시되는 정보의 종류"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "pam_sss로 전송된 PAM 응답 필터링"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr "PAM 요청에 대해 캐쉬된 ID 정보를 유지하는 데 걸리는 시간(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "암호 만료 경고를 표시해야 하는 일 수"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "신뢰할 수 있는 uid 또는 사용자 이름 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "신뢰할 수 없는 사용자도 액세스할 수 있는 도메인 목록입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "사용자 계정이 만료되면 정보가 출력됩니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "사용자 계정이 잠겨 있을 때 출력되는 정보입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "인증서 기반/스마트 카드 인증을 허용합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "PKCS#11 모듈은 인증서가 있는 데이터베이스의 경로입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "PAM 인증하기 위해서 인증서를 확인 조정합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "p11_child가 완료될 때까지 pam_ss가 몇 초 동안 대기합니까"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr "응용프로그램 도메인에 접속 할 수 있는 PAM 서비스"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "스마트카드 사용을 허용 서비스"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "요청 시 카드를 기다리는 추가 시간 초과"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr "스마트 카드 인증을 위한 장치 선택을 제한하는 PKCS#11 URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "PAM 응답자는 언제 initgroups 요청을 강제 실행합니까"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "GSSAPI 인증할 수 있는 PAM 서비스 목록입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "인증된 UPN과 대상 사용자와 일치시킬지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -376,27 +372,27 @@ msgstr ""
 "GSSAPI 인증을 사용하여 PAM 접근 허용해야 하는 <PAM 서비스>:<인증 표시기> 쌍 "
 "목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "패스키 장치 인증을 허용합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "passkey_child가 완료될 때까지 pam_sss가 몇 초 동안 대기합니까"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "libfido2 라이브러리에서 디버깅 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "sudo 규칙에서 시간 기반 속성을 평가할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "true인 경우 SSSD는 낮은 승률의 주문 논리로 다시 전환합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -404,48 +400,48 @@ msgstr ""
 "한 번에 새로 고칠 수 있는 최대 규칙 수입니다. 이를 초과하면 전체 새로 고침이 "
 "수행됩니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "known_hosts 파일에서 호스트 이름과 주소를 해시(hash)할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 "호스트 키가 요청된 후 호스트를 known_hosts 파일에 유지하는 데 걸리는 시간(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "신뢰할 수 있는 CA 인증서 저장 경로"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "인증서에서 ssh 키 생성 허용"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr "다음 일치 규칙을 사용하여 ssh 키 생성을 위한 인증서를 필터링합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr "PAC 응답자에 접근할 수 있는 UID 또는 사용자 이름 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "PAC 데이터가 유효한 것으로 간주되는 기간"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "PAC 검증"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "InfoPipe가 게시할 수 있는 사용자 속성 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -455,7 +451,7 @@ msgstr ""
 "다. 일부 - 사용자 및 그룹 옵션에서 지정한 사용자/그룹이 기록됩니다. all - 모"
 "든 사용자가 기록됩니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -464,7 +460,7 @@ msgstr ""
 "세션 기록을 활성화해야 하는 쉼표로 구분된 사용자 목록입니다. NSS에서 반환된 "
 "사용자 이름과 일치합니다. 가능한 공간 교체 후, 케이스 변경 등."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -473,229 +469,229 @@ msgstr ""
 "쉼표로 구분된 그룹 목록으로, 그 구성원은 세션 기록을 활성화해야 합니다. NSS에"
 "서 반환된 그룹 이름과 일치합니다. 가능한 공간 교체 후, 케이스 변경 등."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr "scope=all인 경우에만 기록에서 제외할 쉼표로 구분된 사용자 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 "scope=all인 경우에만 기록에서 제외되어야 하는 쉼표로 구분된 그룹 목록입니다. "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "ID 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "인증 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "접근 제어 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "비밀번호 변경 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "autofs 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "호스트 ID 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "SELinux 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "세션 관리 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "해결 공급자"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "도메인이 OS 또는 응용프로그램에서 사용 가능한지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "도메인 활성화 또는 비활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "최소 사용자 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "최대 사용자 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "모든 사용자/그룹 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "오프라인 접속을 위한 캐쉬 자격 증명"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "정규화된 형식으로 사용자/그룹 표시"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "그룹 검색에 그룹 구성원을 포함하지 마십시오"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "항목 캐쉬 시간 초과 길이(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr "DNS 검색을 수행할 때 특정 주소 계열을 제한하거나 선호합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr "마지막 접속 성공 후 캐쉬된 항목을 보관할 기간(일)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 "다음 서버를 시도하기 전에 SSSD가 단일 DNS 서버와 통신해야 하는 시간(밀리초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "단일 DNS 쿼리를 해결하기 위해 계속 시도해야 하는 시간(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr "서버를 확인할 때 DNS의 응답을 기다리는 시간(초)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "서비스 검색 DNS 쿼리의 도메인 부분"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "이 값으로 ID 공급자의 GID 값 재정의"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "사용자 이름을 대소문자 구분"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "만료된 항목을 백그라운드에서 새로고침하는 빈도"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr "백그라운드에서 만료된 항목을 갱신 할 때 최대 기간 편차"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "클라이언트의 DNS 항목을 자동으로 최신화 할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "최신화 후 클라이언트의 DNS 항목에 적용 하려는 TTL"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "동적 DNS 최신화에 IP를 사용해야 하는 연결장치"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "클라이언트의 DNS 항목을 주기적으로 최신화하는 빈도"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "클라이언트의 DNS 항목을 최신화 할 때 최대 주기 편차"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "공급자가 PTR 레코드도 명시적으로 최신화해야 하는지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "nsupdate 유틸리티가 기본적으로 TCP를 사용하도록 할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr "DNS 최신화를 수행하기 위해 어떤 종류의 인증을 사용해야 하는지"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "DNS 최신화를 수행하는 데 사용되는 DNS 서버 재정의"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "신뢰할 수 있는 도메인의 제어"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "하위 도메인 목록을 새로 고침 하는 빈도"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "하위 도메인 목록을 갱신 할 때에 최대 기간 편차"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "하위 도메인으로 상속되어야 하는 옵션 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "기본 하위 도메인 homedir 값"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr "캐쉬된 자격 증명은 캐쉬된 인증을 위해 사용 될 수 있는 기간"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "사용자를 위한 비공개 그룹을 자동으로 생성할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "비밀번호가 만료되기 N일 전에 경고를 표시합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr "이 도메인을 위한 realmd 구성 서비스에 의해 저장된 다양한 태그."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -703,7 +699,7 @@ msgstr ""
 "하위 도메인 가져오기를 처리해야 하는 공급자. 이와 같은 값은 항상 id_provider"
 "와 같아야 합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -711,7 +707,7 @@ msgstr ""
 "새롭게 한 후에 호스트 ssh 키를 유지해야 할 시간(초). IE 호스트 키를 캐쉬하는 "
 "기간."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -721,106 +717,106 @@ msgstr ""
 "이 값은 첫 번째 인증 요소(장기 비밀번호)가 SHA512 해쉬로 캐쉬에 저장되어야 하"
 "는 최소 길이를 결정합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "로컬 인증 방법 정책. "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA 도메인"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA 서버 주소"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "백업 IPA 서버의 주소"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA 클라이언트 호스트네임"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "FreeIPA에서 클라이언트의 DNS 항목을 자동으로 최신화 할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "HBAC와 연관된 객체를 위한 검색 기반"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "IPA 서버에 대응하는 HBAC 규칙의 검색 사이에서 시간의 양"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr "IPA 서버에 대응하는 SELinux 맵의 검색 사이에서 초 단위 시간의 양"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr "거짓으로 설정하면, PAM에서 제공한 호스트 인수가 무시됩니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "이와 같은 IPA 클라이언트가 사용 중인 오토마운터 위치"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "IPA 도메인에 대한 정보가 포함된 객체 검색 기반"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "ID 범위에 대한 정보가 포함된 객체 검색 기반"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "DNS 사이트 활성화 - 위치 기반 서비스 검색"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "보기 컨테이너의 검색 기준"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "보기 컨테이너의 객체 클래스"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "보기 이름이 있는 속성"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "덮어쓰기 객체의 객체 클래스"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "원본 객체에 대한 참조가 있는 속성"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "사용자 덮어쓰기 객체의 객체 클래스"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "그룹 덮어쓰기 객체의 객체 클래스"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "데스크탑 프로필 관련 개체 검색 기준"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 "IPA 서버에 대응하는 데스크탑 프로파일 규칙의 검색 사이에서 초 단위 시간의 양"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -828,104 +824,104 @@ msgstr ""
 "마지막 요청이 규칙을 찾지 못한 경우 IPA 서버에 대한 데스크탑 프로필 규칙 검"
 "색 간격(분)입니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "SUBID 범위를 위한 기반 검색"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "액세스 제어를 평가하기 위해 사용해야 하는 규칙"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "호스트의 FQDN이 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "LDAP에서 호스트 항목의 개체 클래스입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "지정된 문자열을 호스트 오브젝트의 검색 기준으로 사용합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "호스트의 SSH 공개 키가 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "netgroup의 NIS 도메인 이름을 포함하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "netgroup 멤버의 이름이 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 "netgroup의 멤버인 호스트 및 호스트 그룹의 FQDN을 나열하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 "netgroup의 직접 구성원인 호스트 및 호스트 그룹을 나열하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "netgroup의 멤버십을 나열하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 "netgroup의 직접 구성원인 시스템 사용자 및 그룹을 나열하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "netgroup 이름에 해당하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "LDAP에서 netgroup 항목의 개체 클래스입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "LDAP netgroup 개체의 UUID/GUID가 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr "사용자 맵이 사용 가능한지 여부를 포함하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "호스트 범주(예: 'all')가 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr "이 규칙이 일치하는 모든 호스트/호스트그룹이 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr "이 규칙이 일치하는 모든 사용자 / 그룹이 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "SELinux 사용자 맵의 이름이 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -933,19 +929,19 @@ msgstr ""
 "memberUser 및 memberHost 대신 일치하는 데 사용할 수 있는 HBAC 규칙의 DN이 포"
 "함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "SELinux 사용자 문자열 자체를 포함하는 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "'all'과 같은 사용자 범주가 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "사용자 맵의 고유 ID가 포함된 LDAP 속성입니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -953,335 +949,335 @@ msgstr ""
 "이 옵션은 SSSD가 IPA 서버에서 실행 중임을 나타내며 신뢰할 수 있는 도메인에서 "
 "사용자 및 그룹의 검색을 다르게 수행해야 함을 나타냅니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "주어진 문자열을 신뢰할 수 있는 도메인의 검색 기반으로 사용합니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active Directory 도메인"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Active Directory 도메인 사용"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Active Directory 서버 주소"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Active Directory 백업 서버 주소"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Active Directory 클라이언트 호스트 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "액세스 권한을 결정하는 LDAP 필터"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "검색에 Global Catalog 사용 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "GPO 기반 액세스 제어를 위한 작동 모드"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "AD 서버에 대응하는 GPO 정책 파일의 검색 사이에서 시간의 양"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr "GPO(거부)InteractiveLogonRight 정책 설정에 매핑되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 "GPO(거부)RemoteInteractiveLogonRight 정책 설정에 매핑되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr "GPO(거부)NetworkLogonRight 정책 설정에 매핑되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr "GPO (거부)BatchLogonRight 정책 설정에 매핑되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr "GPO (거부)ServiceLogonRight 정책 설정에 매핑되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "GPO 기반 액세스가 항상 부여되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "GPO 기반 액세스가 항상 거부되는 PAM 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "매핑되지 않은 PAM 서비스 이름에 사용할 기본 로그온 권한 (또는 허용/거부)"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "클라이언트가 사용할 특정 사이트"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr "장비 계정 비밀번호를 갱신하기 전의 최대 사용 기간(일)"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "시스템 계정 갱신 작업 조정 옵션"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr "삼바 데이터베이스에서 시스템 계정 비밀번호를 최신화 할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "LDAP 및 글로벌 카탈로그 요청에 LDAPS 포트 사용"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "다른 도메인에서 도메인 로컬 그룹을 필터링하지 않음"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos 서버 주소"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Kerberos 백업 서버 주소"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos 영역"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "인증 시간 제한"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "kdcinfo 파일을 생성할지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "krb5 구성 스니펫을 드롭할 위치"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "인증 정보 캐쉬를 저장 할 디렉토리"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "사용자 인증 정보 캐쉬의 위치"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "인증 정보 유효성을 검사하기 위한 keytab의 위치"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "인증 정보 검증 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "나중에 온라인 인증을 위해 오프라인일 경우 암호 저장"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "TGT의 재생 가능 수명"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "TGT의 수명"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "두 검사 사이의 갱신 기간"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "FAST 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "FAST에 사용할 주체를 선택"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "익명 PKINIT를 사용하여 FAST 인증서를 요청합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "주체 표준화 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "기업 주체 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "인증에 하위 도메인 영역 사용 활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "사용자 이름에서 Kerberos 주체 이름으로 매핑"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "KDC가 아닌 경우 변경 암호 서비스가 실행 중인 서버"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, LDAP 서버의 URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, LDAP 서버의 URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "기본 DN의 기본값"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "LDAP 서버에서 사용되는 스키마 유형 rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "사용자 비밀번호를 변경하는 데 사용되는 방식"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "기본 바인딩 DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "기본 바인드 DN의 인증 토큰 유형"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "기본 바인드 DN의 인증 토큰"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "연결을 시도할 시간"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "동기식 LDAP 작업을 시도하는 시간"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "오프라인 상태일 때 다시 연결을 시도하는 간격"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "영역 이름에 대해 대문자만 사용하십시오"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "CA 인증서가 포함된 파일"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "CA 인증서 디렉토리의 경로"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "클라이언트 인증서가 포함된 파일"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "클라이언트 키가 포함된 파일"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "가능한 암호화 제품군 목록"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "TLS 인증서 확인 필요"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "사용할 sasl 메커니즘 지정"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "사용할 sasl 권한 부여 ID를 지정"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "사용할 sasl 권한 부여 영역을 지정"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "LDAP sasl 권한 부여에 대한 최소 SSF를 지정"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "LDAP sasl 권한 부여에 대한 최대 SSF를 지정"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Kerberos 서비스 키탭"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "LDAP 연결에 Kerberos 인증 사용"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "LDAP 참조 준수"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "LDAP 연결을 위한 TGT의 수명"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "별칭 역참조 방법"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "DNS 서비스 검색을 위한 서비스 이름"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "단일 LDAP 쿼리에서 검색할 레코드 수"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr "전체 참조 해제를 트리거하려면 누락되어야 하는 구성원 수"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "읽을 수 없는 LDAP 참조를 무시합니다"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1289,7 +1285,7 @@ msgstr ""
 "LDAP 라이브러리에서 SASL 바인드 중에 호스트 이름을 정식화하기 위해 역방향 검"
 "색을 수행해야 하는지 여부"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1297,30 +1293,36 @@ msgstr ""
 "로컬 사용자를 RFC2307 스키마를 사용하는 서버의 LDAP 그룹의 구성원으로 유지할 "
 "수 있습니다."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN 속성"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN 속성"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "연결을 끊기 전에 LDAP 서버에 대한 연결을 유지하는 시간"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "LDAP 페이징 제어 비활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Active Directory 범위 검색 비활성화"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "검색 요청 대기 시간"
@@ -1912,33 +1914,33 @@ msgstr "passwd 파일 소스 경로입니다."
 msgid "Path of group file sources."
 msgstr "그룹 파일 소스의 경로입니다."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "색인 동작이 실패함: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "데몬이 됨 (기본값)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "대화식 실행 (데몬이 아님)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "버전 번호를 인쇄하고 종료합니다"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1949,97 +1951,97 @@ msgstr ""
 "잘못된 옵션 %s: %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "옵션 -i|--interactive는 -D|--daemon과 함께 사용할 수 없습니다.\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "메모리 부족\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "코어 덤프 허용"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "디버그 로그의 오픈 파일 설명자"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "FAST ccache를 생성할 사용자"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "FAST ccache를 생성할 그룹"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "익명의 PKINIT를 사용하여 FAST 강화된 티켓을 요청합니다"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "사용할 Kerberos 영역"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "티켓의 요청된 수명"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "티켓의 요청된 재생 가능 수명"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "FAST 옵션 ('never', 'try', 'demand')"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "FAST에 사용할 서버 주체를 지정"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "주체 이름의 정규화 요청"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "krb5_get_init_creds_password의 사용자 지정 버전 사용"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "로깅 목적을 위해 사용되는 T이벤트 체인 ID"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "PAC 플래그 점검"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "blockoc_asprintf에 실패했습니다.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd가 실패했습니다.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "정보 공급자의 도메인 (필수)"
 
@@ -2073,66 +2075,66 @@ msgstr "오류가 발생했지만 설명을 찾을 수 없습니다."
 msgid "Unexpected error while looking for an error description"
 msgstr "오류 설명을 찾는 동안 예기치 않은 오류 발생"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "권한이 거부되었습니다. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "서버 메시지: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 "커버러스 TGT는 로그인 시 허용되지 않으며, 사용자 환경에 영향을 미칩니다."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "PIN 입력:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "암호가 일치하지 않습니다"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "root로 재설정한 암호는 지원되지 않습니다."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "캐쉬된 인증 정보로 인증됨"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", 당신의 캐쉬된 비밀번호는 다음에 만료됩니다.: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "암호가 만료되었습니다. %1$d 유예 로그인이 남아 있습니다."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "암호는 %1$d %2$s에 만료됩니다."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "당신의 비밀번호가 만료되었습니다."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "인증은 다음 기간까지 거부됩니다. "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "시스템이 오프라인 상태이며 암호가 변경될 수 없습니다"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2140,11 +2142,11 @@ msgstr ""
 "OTP 비밀번호를 변경한 후, 티켓을 받으려면 로그아웃한 후 다시 로그인해야 합니"
 "다"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN 잠금"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2152,66 +2154,66 @@ msgstr ""
 "서버가 이와 같은 방식을 지원하지 않으므로 커버러스 TGT가 허용되지 않습니다. "
 "통합인증(SSO) 환경이 영향을 받습니다."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "비밀번호 변경에 실패함. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "%1$s에 인증하고 ENTER를 누릅니다."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "PIN %1$s(%2$s에서)으로 인증하고 ENTER를 누릅니다."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "다른 스마트카드를 (다시)입력해 주세요"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "신규 비밀번호: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "신규 비밀번호 재입력: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "첫 번째 요인: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "두 번째 요인(선택 사항): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "두 번째 요인: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "자신의 패스키 장치를 넣고, 그런 후에 Enter를 눌러주세요."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "비밀번호: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "첫 번째 요인 (현재 비밀번호): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "현재 비밀번호: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "비밀번호가 만료되었습니다. 지금 비밀번호를 변경하세요."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "실행할 디버그 수준"
 
@@ -2220,7 +2222,7 @@ msgstr "실행할 디버그 수준"
 msgid "The SSSD domain to use"
 msgstr "사용할 SSSD 도메인"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "로케일을 설정하는 도중 오류 발생\n"
 
@@ -2282,85 +2284,89 @@ msgstr "sss_ssh_knownhostsproxy: 호스트 %s 포트 %d에 연결: %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: 호스트 이름을 확인할 수 없습니다 %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "지정한 검색과 일치하는 캐쉬 대상이 없습니다\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "비활성화할 수 없습니다 %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "비활성화할 수 없습니다 %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "캐쉬된 모든 항목을 무효화합니다"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "특정 사용자를 무효화합니다"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "모든 사용자를 무효화합니다"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "특정 그룹을 무효화합니다"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "모든 그룹을 무효화합니다"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "특정 netgroup을 무효화합니다"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "모든 netgroup을 무효화합니다"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "특정 서비스를 무효화합니다"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "모든 서비스를 무효화합니다"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "특정 autofs 맵 무효화"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "모든 autofs 맵 무효화"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "특정 SSH 호스트 무효화"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "모든 SSH 호스트 무효화"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "특정 sudo 규칙을 무효화"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "캐쉬된 모든 sudo 규칙을 무효화"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "특정 도메인의 항목만 무효화"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2368,11 +2374,11 @@ msgstr ""
 "예기치 않은 인수가 제공되었습니다. 단일 오브젝트를 무효화하는 옵션은 제공된 "
 "단일 인수만 허용합니다.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "무효화할 개체를 하나 이상 선택하십시오.\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2381,7 +2387,7 @@ msgstr ""
 "%1$s 도메인을 열 수 없습니다. 도메인이 하위 도메인(신뢰할 수 있는 도메인)인 "
 "경우 --domain/-d 매개변수 대신 정규화된 이름을 사용합니다.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "사용 가능한 도메인을 열 수 없습니다\n"
 
@@ -2415,163 +2421,163 @@ msgstr "사용자 입력을 읽을 수 없습니다\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "잘못된 입력, '%s' 또는 '%s'를 입력하십시오.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "외부 명령을 실행하는 도중 오류 발생\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "외부 명령 '%s'을 실행하는 도중 오류 발생\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "명령 '%s'이(가) [%d]에 실패했습니다\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "SSSD를 실행해야 합니다. 지금 SSSD를 시작하시겠습니까?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "SSSD가 실행되고 있지 않아야 합니다. 지금 SSSD를 중지하시겠습니까?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "SSSD를 다시 시작해야 합니다. 지금 SSSD를 다시 시작하시겠습니까?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "SSSD 상태:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "사용 가능한 도메인을 나열합니다"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "도메인에 대한 정보 출력"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "사용자에 대한 정보 출력과 인증 점검"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "도메인을 위한 접근 보고를 발생합니다"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "캐쉬된 내용에 대한 정보:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "캐쉬된 사용자에 대한 정보"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "캐쉬된 그룹에 대한 정보"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "캐쉬된 넷그룹에 대한 정보"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "로컬 자료 도구:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "로컬 자료 백업"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "백업에서 로컬 자료 복원"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "로컬 자료를 백업하고 캐쉬된 내용을 제거"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "캐쉬된 객체 무효화"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "캐쉬 색인을 관리합니다"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "기록 파일 도구:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "기존 SSSD 기록 파일 제거"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "tarball에서 SSSD 기록 파일 보관"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "SSSD 디버그 수준에 대한 정보 변경 또는 출력"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "로그인된 자료를 분석합니다"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "구성 파일 도구:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "SSSD 구성의 통계 분석을 수행합니다"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "인증서 관련된 도구:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "인증서에 대한 정보 출력"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "인증서에 대응된 사용자 표시"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "인증서를 사용하여 매핑 및 일치 규칙 확인"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 #, fuzzy
 msgid "GPOs related tools:"
 msgstr "Passkey와 연관된 도구:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "캐쉬된 사용자에 대한 정보"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Passkey와 연관된 도구:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "패스키 등록을 수행합니다"
 
@@ -2626,7 +2632,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "오류: [%d] 개체를 가져올 수 없음: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: [%d] 값을 읽을 수 없음: %s\n"
@@ -2640,217 +2646,217 @@ msgstr "이름을 지정합니다."
 msgid "Unable to parse name %s.\n"
 msgstr "%s 이름을 구문 분석할 수 없습니다.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "SID로 검색"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "사용자 ID로 검색"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Initgroups 만료 시간"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "그룹 ID로 검색"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 #, fuzzy
 msgid "Search by GPO guid"
 msgstr "그룹 ID로 검색"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "명령 행을 구문 분석하는데 실패함: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "객체를 출력하는 데 실패함: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 #, fuzzy
 msgid "talloc failed\n"
 msgstr "malloc에 실패했습니다.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 #, fuzzy
 msgid "Unable to get attribute list!\n"
 msgstr "서버 목록을 가져올 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "캐쉬 파일을 제거 할 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 #, fuzzy
 msgid "Unable to get GPOs base DN\n"
 msgstr "서버 목록을 가져올 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "sysdb를 검색 할 수 없음: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "메세지를 sysdb attr로 변환 할 수 없음: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "내려받은 GPO 파일을 제거 할 수 없음: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "캐쉬 항목을 가져오는 데 실패함: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "사용 가능한 도메인을 열 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "GPO를 삭제하는 데 실패함: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "디버그 정보를 표시합니다"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "base64로 인코딩된 인증서를 지정합니다."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "시스템 버스에 연결할 수 없습니다!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - 매핑된 사용자를 찾을 수 없음 -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "맵핑 규칙"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "일치 규칙"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "명령 인수를 구문 분석 할 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "메모리 부족!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "certmap 컨텍스트를 설정하지 못했습니다.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr "오류 [%d][%s]와 함께 매핑 및 일치 규칙을 추가하지 못했습니다.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "base64 문자열을 디코딩하지 못했습니다.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "인증서가 규칙과 일치합니다.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "인증서가 규칙과 일치하지 않습니다.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "인증서를 일치하는 동안 [%d][%s] 오류가 발생했습니다.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "매핑 필터를 생성하지 못했습니다 [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2863,7 +2869,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2873,35 +2879,35 @@ msgstr ""
 "한 위치를 검색하는 것입니다. 예를 들어 구성이 \"/my/path/sssd.conf\"로 설정"
 "된 경우 스니펫 디렉토리 \"/my/path/conf.d\"가 사용됨)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "파일 %1$s이 존재하지 않음.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "구성이 없습니다.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "'%s'를 읽는데 실패했습니다: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "검증기를 실행하지 못했습니다"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "검증기로 식별된 문제: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "구성 병합 중에 생성된 메시지: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "사용된 구성 스니펫 파일: %zu\n"
@@ -2923,100 +2929,100 @@ msgstr "사용자 덮어쓰기를 내보낼 수 없습니다\n"
 msgid "Unable to export group overrides\n"
 msgstr "그룹 덮어쓰기를 내보낼 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "기존 백업 덮어쓰기"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "사용자 덮어쓰기를 가져올 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "그룹 덮어쓰기를 가져올 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "SSSD가 실행 중이 아닌 경우 시작"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "데이터 가져 오기 후 SSSD 재시작"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "정리된 캐쉬 파일을 만들고 로컬 자료 가져 오기"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "캐쉬를 제거하기 전에 SSSD 중지"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "캐쉬가 제거될 때 SSSD를 시작합니다"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "로컬 데이터의 백업 생성 중...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr "로컬 데이터의 백업을 생성 할 수 없으며, 캐쉬를 제거 할 수 없습니다.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "캐쉬 파일 제거 중...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "캐쉬 파일을 제거 할 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "로컬 데이터 복원 중...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "도메인 %1$s를 위해 캐쉬 색인을 생성하기\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "도메인 %1$s를 위해 캐쉬 색인을 삭제하기\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "도메인 %1$s을 위한 색인:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  속성: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "대상 지정 도메인"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "도메인"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "색인 할 속성"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "속성"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "동작이 제공되지 않음\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3025,180 +3031,180 @@ msgstr ""
 "알지 못하는 동작: %1$s\n"
 "유효한 동작은 \"%2$s\", \"%3$s 및 \"%4$s\"입니다\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "속성이 제공되지 않음\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "속성 %1$s가 색인되지 않았습니다.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "속성 %1$s가 이미 색인되었습니다.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "색인 동작이 실패함: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "원격 공급자에서도 색인을 최신화하는 것을 잊지 마세요.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr "메인 또는 신뢰할 수 있는 도메인 유형을 포함한 도메인 목록 표시"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "온라인"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "오프라인"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "온라인 상태: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "이 도메인에는 활성 서버가 없습니다.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "활성 서버:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "연결되지 않음"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "서버를 찾을 수 없습니다.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "검색된 %s 서버:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "지금까지는 없습니다.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "온라인 상태 표시"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "활성 서버에 대한 정보 표시"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "검색된 서버 목록 표시"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "도메인 이름을 지정합니다."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "온라인 상태를 얻는 데 실패\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "서버 목록을 가져올 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD가 실행 중이 아닙니다.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s 알려지지 않은 도메인\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s 접근 할 수 없는 서비스\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "자르는 대신 로그 파일 삭제"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "로그 파일 삭제 중...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "로그 파일을 제거 할 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "로그 파일 자르는 중...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "로그 파일을 자를 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "%s에 로그 파일 보관 중...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "로그 파일을 보관할 수 없습니다\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "대상 SSSD 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "대상 NSS 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "대상 PAM 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "대상 SUDO 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "대상 AUTOFS 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "대상 SSH 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "대상 PAC 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "대상 IFP 서비스"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "설정할 디버그 수준 지정"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "오류: T이벤트 체인 ID 지원이 누락되었으며, 로그 분석이 지원되지 않습니다.\n"
@@ -3264,19 +3270,19 @@ msgstr ""
 " -쉘: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "PAM 동작 [auth|acct|setc|chau|open|clos], 기본설정: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "PAM 서버스, 기본설정: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "사용자 이름을 지정합니다."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3289,22 +3295,22 @@ msgstr ""
 "서비스: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "[%s]을/를 사용한 사용자 이름 검색에 실패했습니다.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "[%s]을(를) 사용한 InfoPipe 사용자 검색에 실패했습니다.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start에 실패: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3312,12 +3318,12 @@ msgstr ""
 "pam_authenticate 테스트\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item에 실패: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3326,7 +3332,7 @@ msgstr ""
 "[%s] 사용자에 대한 pam_authenticate: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3334,7 +3340,7 @@ msgstr ""
 "pam_chauthtok 테스트\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3343,7 +3349,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3351,7 +3357,7 @@ msgstr ""
 "pam_acct_mgmt 테스트\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3360,7 +3366,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3368,7 +3374,7 @@ msgstr ""
 "pam_setcred 테스트\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3377,7 +3383,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3385,7 +3391,7 @@ msgstr ""
 "pam_open_session 테스트\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3394,7 +3400,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3402,7 +3408,7 @@ msgstr ""
 "pam_close_session 테스트\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3411,26 +3417,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "알 수 없는 동작\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "PAM 환경:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " -환경이 없음 -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "기본이 아닌 config 파일 지정"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "응답자가 소켓-활성화되었음을 알립니다"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "자료(데이타) 공급자에 대한 연결 시도 횟수"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "netlink 인터페이스 비활성화"
 
diff --git a/po/nb.po b/po/nb.po
index 00dfa678e97..f472372f8c3 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:46-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Norwegian Bokmål (http://www.transifex.com/projects/p/sssd/"
@@ -46,26 +46,22 @@ msgid "Command to start service"
 msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -73,63 +69,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD-tjenester som skal startes"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD-domener som skal startes"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -137,1131 +133,1137 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Identitetstilbyder"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Autentiseringstilbyder"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Tilgangskontrolltilbyder"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Passordbyttetilbyder"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Minste bruker-ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Største bruker-ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA-domene"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA-tjeneradresse"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Vertsnavn for IPA-klient"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Tjeneradresse for Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos-område"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Tidsavbrudd for autentisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1845,32 +1847,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1878,97 +1880,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2000,140 +2002,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2142,7 +2144,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2204,102 +2206,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2333,161 +2339,161 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2541,7 +2547,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2555,211 +2561,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2768,42 +2774,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2825,282 +2831,282 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA-domene"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Autentiseringstilbyder"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3163,19 +3169,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3184,121 +3190,121 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
diff --git a/po/nl.po b/po/nl.po
index ce8653a7d79..2ec1c03c715 100644
--- a/po/nl.po
+++ b/po/nl.po
@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:47-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Dutch (http://www.transifex.com/projects/p/sssd/language/"
@@ -51,28 +51,24 @@ msgid "Command to start service"
 msgstr "Commando om service te starten"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Aantal pogingen naar de Data Providers te verbinden"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "Het aantal bestand descriptors die door deze beantwoorder geopend mogen "
 "worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Duur van inactiviteit voor het automatisch loskoppelen van een cliënt"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -80,23 +76,23 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD Services die gestart moeten worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD Domeinen die gestart moeten worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Reguliere expressie om gebruikersnamen en domeinen te ontleden"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Printf-compatibel formaat voor het tonen van namen in volledige vorm"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -104,41 +100,41 @@ msgstr ""
 "Map in het bestandssysteem waarin SSSD Kerberos replay cache bestanden moet "
 "opslaan."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Domein toe te voegen aan namen zonder een domein component."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -146,78 +142,78 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Enumeratie cache timeout duur (in seconden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Entry cache achtergrond update timeout duur (in seconden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Negatieve cache timeout duur (in seconden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Gebruikers die SSSD expliciet dient te negeren"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Groepen die SSSD expliciet dient te negeren"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Dienen gefilterde gebruikers zichtbaar te zijn in groepen"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "De waarde van het wachtwoordveld die de NSS aanbieder terug moet geven"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Overschrijf homedir waarde van de identiteit aanbieder met deze waarde "
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Vervang lege persoonlijke map waarde van de eindentiteitsaanbieder met deze "
 "waarde"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "Overschrijf shell waarde van identiteit provider met deze waarde"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "De lijst van shells waarmee ingelogd kan worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "De lijst van shells die verboden zijn, en vervangen door de fallback shell"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -225,60 +221,60 @@ msgstr ""
 "Als een shell opgeslagen in de centrale map toegestaan is, maar niet "
 "beschikbaar, gebruik dan deze"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Te gebruiken shell als de aanbieder er geen aangeeft "
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Hoe lang zullen cache records in het geheugen geldig blijven"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr "Hoe lang zijn cached logins toegestaan tussen online logins (in dagen)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Hoe veel mislukte inlogpogingen zijn toegestaan in offline-modus"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -286,128 +282,128 @@ msgstr ""
 "Hoe lang (in minuten) logins weigeren nadat offline_failed_login_attempts is "
 "bereikt"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 "Welke boodschappen worden aan de gebruiker getoond tijdens authenticatie"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Hoeveel seconden moet de identiteit informatie in cache opgeslagen worden "
 "voor PAN aanvragen"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 "Hoeveel dagen voor het verlopen van het wachtwoord moet een waarschuwing "
 "getoond worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Vereis verificatie van het TLS-certificaat"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 "Of de tijd-gebaseerde attributen in sudo regels moeten worden geëvalueerd"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "Moeten host namen en adressen gehashd worden in het known_hosts bestand"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -415,347 +411,347 @@ msgstr ""
 "Hoeveel seconden moet een host in het known_hosts bestand blijven nadat de "
 "host sleutels ervan werden aangevraagd"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Lijst met UID's of gebruikersnamen waarvoor toegang tot de PAC responder "
 "toegestaan is"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Identiteitaanbieder"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Authentiecatieaanbieder"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Toegangscontroleaanbieder"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Wachtwoordwijzigingsaanbieder"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO provider"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs provider"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Host identity provider"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "Schakel authenticatiegegevensvalidatie in"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Minimum gebruiker ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Maximum gebruiker ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Schakel enumeratie van alle gebruikers/groepen"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Cache inloggegevens voor offline gebruik"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Laat gebruikers/groepen in volledige vorm zien"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Neem groepsleden niet mee in groep zoekacties"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Entry cache timeout duur (in seconden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Beperk of geef de voorkeur aan een specifieke adresfamilie wanneer er DNS-"
 "lookups uitgevoerd worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Hoe lang blijven gegevens opgeslagen na een succesvolle login (in dagen)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Hoe lang te wachten op antwoord van de DSN bij het opzoeken van servers (in "
 "seconden)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Het domeingedeelte van DNS queries die service discovery uitvoeren"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Overschrijf GID waarde van de identiteit aanbieder met deze waarde"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Behandel gebruikersnamen als hoofdlettergevoelig"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Hoe vaak moeten verlopen ingangen op de achtergrond ververst worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Of de DNS ingang van de cliënt automatisch vernieuwd moet worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 "De TTL die toegepast moet worden op de DNS ingang van de cliënt na het "
 "vernieuwen hiervan"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "De adapter wiens IP-adres gebruikt moet worden voor het dynamisch bijwerken "
 "van de DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Hoe vaak de DNS ingang van de client periodiek vernieuwd moet worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 #, fuzzy
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Hoe vaak de DNS ingang van de client periodiek vernieuwd moet worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "Of de provider ook de PTR record expliciet moet vernieuwen"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Of het nsupdate hulpprogramma standaard TCP moet gebruiken"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Welke soort authenticatie moet gebruikt worden om de DNS vernieuwing uit te "
 "voeren"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA-domein"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA-serveradres"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adres van back-up IPA server"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA-clienthostname"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "Of de DNS-gegevens van de client automatisch bijgewerkt moeten worden in "
 "FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Zoek basis voor HBAC gerelateerde objecten"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "De tijdsduur tussen het opzoeken van HBAC regels voor de IPA server"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
@@ -763,528 +759,528 @@ msgstr ""
 "De tijdsduur in seconden tussen zoekopdrachten in de SELinux mappen voor de "
 "IPA server"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Als dit op false ingesteld is, wordt het host argument gegeven door PAM "
 "genegeerd"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "De automounter locatie die door deze IPA client wordt gebruikt"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "Zoek in base voor object die info over IPA domein bevat  "
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "Zoek in base voor objecten die info over ID bereiken bevat"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Zet DNS sites aan - locatie gebaseerde service ontdekking"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 #, fuzzy
 msgid "Search base for SUBID ranges"
 msgstr "Zoek basis voor HBAC gerelateerde objecten"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 "Welke regels moeten gebruikt worden voor de evaluatie van toegangscontrole"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active Directory domein"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Active Directory server adres"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Active Directory back-up server adres"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Active Directory cliënt hostnaam"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "LDAP-filter om toegangsprivileges mee te bepalen"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos-serveradres"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Kerberos back-up server adres"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos-rijk"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Authenticatie timeout"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Moeten kdcinfo bestanden aangemaakt worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Werkmap waar authenticatiegegevens opgeslagen worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Locatie van de authenticatiecache van de gebruiker"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Locatie van de keytab om authenticatiegegevens te valideren"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Schakel authenticatiegegevensvalidatie in"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "Sla het wachtwoord op indien offline voor later gebruik bij online "
 "authenticatie"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Vernieuwbare levensduur van de TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Levensduur van de TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Tijd tussen twee checks voor vernieuwing"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Zet FAST aan"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Selecteert de hoofdpersoon te gebruiken voor FAST "
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Zet hoofdpersoon sanctioneren aan"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Zet enterprise principals aan"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Server waar het wachtwoord wijzigingsservice draait indien niet op de KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, de URI van de LDAP server"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, De URI van de LDAP server"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "De standaard base DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Het schema type wat gebruikt wordt op de LDAP server, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "De standaard bind DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Het type authenticatietoken van de standaard bind DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Het authenticatietoken van de standaard bind DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Hoe lang pogen te verbinden"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Hoe lang proberen synchroon LDAP te benaderen"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 "Duur tussen pogingen om de verbinding opnieuw tot stand te brengen tijdens "
 "offline zijn"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Gebruik alleen hoofdletters voor gebiedsnamen"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Bestand dat de bekende CA-certificaten bevat"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Pad naar de CA-certificatenmap"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Bestand dat het client certificaat bevat"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Bestand dat de client sleutel bevat"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Lijst van mogelijke sleutel suites"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Vereis verificatie van het TLS-certificaat"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Geef het SASL-mechanisme op wat gebruikt moet worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Geef het SASL-authorisatie-ID op wat gebruikt moet worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Specificeer het te gebruiken sasl autorisatiegebied  "
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Specificeer de minimale SSF voor LDAP sasl autorisatie"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Kerberos service keytab"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Gebruik Kerberos authenticatie voor LDAP-connectie"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Volg LDAP-doorverwijzingen"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Levensduur van TGT voor LDAP-connectie"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Hoe moet de alias referentie verwijderd worden"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Service naam voor DNS service opzoeken"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 "Het aantal records dat opgehaald moet worden met een enkele LDAP bevraging"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "Het aantal leden van moet ontbreken om een volledige de-referentie te "
 "veroorzaken"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1292,38 +1288,44 @@ msgstr ""
 "Moet de LDAP bibliotheek omgekeerd opzoeken uitvoeren om de hostnaam te "
 "autoriseren tijdens een SASL binding"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN attribuut"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN attribuut"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "Hoe lang een verbinding met de LDAP server gebouden moet blijven voordat het "
 "losgekoppeld wordt"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Het LDAP paging besturingselement uitschakelen"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Zet Active Directory bereik opvragen uit"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Tijd om te wachten op een zoekopdracht"
@@ -1921,33 +1923,33 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "Het post-verwijder commando mislukte: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Start in de achtergrond (standaard)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Start interactief (standaard)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Print versie nummer en sluit af"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -1955,97 +1957,97 @@ msgid ""
 "\n"
 msgstr "Het post-verwijder commando mislukte: %1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Het geheugen zit vol\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Een geopend bestand voor de debug logs"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domein voor de informatie provider (verplicht)"
 
@@ -2080,141 +2082,141 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr "Onverwachtte fout bij het opzoeken van een omschrijving"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Serverbericht:"
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Wachtwoorden komen niet overeen"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Wachtwoorden als root wijzigen wordt niet ondersteund."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Geauthenticeerd met gecachte inloggegevens."
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", uw wachtwoord verloopt op:"
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 "Je wachtwoord is verlopen. Je hebt nog slechts %1$d login(s) beschikbaar."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Je wachtwoord zal verlopen in %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "Je wachtwoord zal verlopen in %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Inloggen wordt geweigerd tot:"
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Systeem is offline, wachtwoord wijzigen niet mogelijk"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Wijzigen van wachtwoord mislukt."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nieuw Wachtwoord: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Voer nieuw wachtwoord nogmaals in: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Wachtwoord: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Huidig wachtwoord:"
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Wachtwoord verlopen. Verander nu uw wachtwoord."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Het debugniveau waarmee gestart wordt"
 
@@ -2223,7 +2225,7 @@ msgstr "Het debugniveau waarmee gestart wordt"
 msgid "The SSSD domain to use"
 msgstr "Hrt te gebruiken SSSD domein"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Fout bij het zetten van de locale\n"
 
@@ -2285,96 +2287,100 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 "Geen enkel cache object komt overeen met de gespecificeerde zoekopdracht\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Maak bepaalde gebruiker ongeldig"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Maak alle gebruikers ongeldig"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Maak bepaalde groep ongeldig"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Maak alle groepen ongeldig"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Maak bepaalde netgroep ongeldig"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Maak alle netgroepen ongeldig"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Maak bepaalde service ongeldig "
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Maak alle services ongeldig"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Maak bepaalde autofs map ongeldig"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Maak alle autofs mappen ongeldig"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Maak alleen ingangen van een bepaald domein ongeldig"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Selecteer tenminste een object om ongeldig te maken\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2384,7 +2390,7 @@ msgstr ""
 "is, gebruik dan de volledig gekwalificeerde naam in plaats van --domain/-d "
 "parameter.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Kon beschikbare domeinen niet openen\n"
 
@@ -2418,165 +2424,165 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 #, fuzzy
 msgid "List available domains"
 msgstr "Kon beschikbare domeinen niet openen\n"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Kan geen informatie ophalen over de gebruiker\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 #, fuzzy
 msgid "Invalidate cached objects"
 msgstr "Maak alle gebruikers ongeldig"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Kan geen informatie ophalen over de gebruiker\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2631,7 +2637,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2645,212 +2651,212 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "Kon beschikbare domeinen niet openen\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2859,42 +2865,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2916,285 +2922,285 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA-domein"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "UID-attribuut"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Authentiecatieaanbieder"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, fuzzy, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Het post-verwijder commando mislukte: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 #, fuzzy
 msgid "SSSD is not running.\n"
 msgstr "SSSD wordt niet door root gestart."
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 #, fuzzy
 msgid "Target the PAM service"
 msgstr "Attribuut voor tonen van geautoriseerde PAM services"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3257,19 +3263,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3278,124 +3284,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Geef een niet-standaard configuratiebestand op"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Aantal pogingen naar de Data Providers te verbinden"
+
 #~ msgid "Privileged socket has wrong ownership or permissions."
 #~ msgstr "Socket met privileges heeft verkeerde rechten of eigendom."
 
diff --git a/po/pl.po b/po/pl.po
index a7d15d1ab00..5b090d89c5d 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2023-09-16 09:18+0000\n"
 "Last-Translator: Piotr Drąg <piotrdrag@gmail.com>\n"
 "Language-Team: Polish <https://translate.fedoraproject.org/projects/sssd/"
@@ -54,31 +54,27 @@ msgid "Command to start service"
 msgstr "Polecenie do uruchomienia usługi"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Liczba prób połączenia do dostawców danych"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 "Liczba deskryptorów plików, które mogą być otwarte przez ten program "
 "odpowiadający"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Czas bezczynności przed automatycznym rozłączeniem klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 "Czas bezczynności przed automatycznym wyłączeniem programu odpowiadającego"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 "Odpytywanie wszystkich pamięci podręcznych za każdym razem przed "
 "odpytywaniem dostawców danych"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -89,23 +85,23 @@ msgstr ""
 "z powrotem do trybu online zwiększy się o czas rozłączenia. Ta wartość jest "
 "w sekundach i jest obliczana według: offline_timeout + random_offset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Usługi SSSD do uruchomienia"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Domeny SSSD do uruchomienia"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Wyrażenie regularne do przetworzenia nazwy użytkownika i domeny"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Format zgodny z printf do wyświetlania w pełni kwalifikowanych nazw"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -113,37 +109,37 @@ msgstr ""
 "Katalog w systemie plików, w którym SSSD ma przechowywać pliki pamięci "
 "podręcznej odtwarzania Kerberosa."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Domeny do dodania do nazw bez składnika domeny."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Użytkownik, któremu porzucić uprawnienia"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Dostraja sprawdzanie poprawności certyfikatów"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Wszystkie spacji w nazwach grup i użytkowników zostaną zastąpione tym znakiem"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 "Dostraja usługę SSSD, aby uwzględniała lub ignorowała zmiany stanu netlink"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Włącza lub wyłącza bezpośrednią domenę plików"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Konkretna kolejność domen do wyszukania"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -151,7 +147,7 @@ msgstr ""
 "Steruje, czy SSSD ma monitorować stan pliku resolv.conf do identyfikacji, "
 "kiedy musi zaktualizować swój wewnętrzny program rozwiązujący DNS."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -163,77 +159,77 @@ msgstr ""
 "używać do tego inotify, i wróci do odpytywania pliku resolv.conf co pięć "
 "sekund, jeśli inotify nie może być używane."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 "Automatycznie uruchamia program odpowiadający PAC w przypadku dostawców AD "
 "i IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "Włącza lub wyłącza zrzuty core dla wszystkich procesów SSSD."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Dostraja zachowanie sprawdzania poprawności haseł-kluczy"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Czas oczekiwania pamięci podręcznej wyliczania (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Czas oczekiwania aktualizacji tła pamięci podręcznej wpisów (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Ujemny czas oczekiwania pamięci podręcznej (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Ujemny czas oczekiwania pamięci podręcznej plików (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Użytkownicy, którzy mają być bezpośrednio ignorowani przez SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Grupy, które mają być bezpośrednio ignorowane przez SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Czy filtrowani użytkownicy mają pojawiać się w grupach"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Wartość pola hasła, jaką dostawca NSS ma zwrócić"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr "Zastępuje wartość katalogu domowego z dostawcy tożsamości tą wartością"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Zastępuje pustą wartość katalogu domowego z dostawcy tożsamości tą wartością"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "Zastępuje wartość powłoki od dostawcy tożsamości tą wartością"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Lista powłok, za pomocą których użytkownicy mogą się logować"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "Lista powłok, które zostaną zawetowane i zastąpione powłoką zastępczą"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -241,15 +237,15 @@ msgstr ""
 "Jeśli powłoka przechowywana w katalogu centralnym jest dozwolona, ale nie "
 "jest dostępna, to zostanie użyta ta powłoka zastępcza"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Powłoka do użycia, jeśli dostawca nie dostarcza żadnej"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Jak długo wpisy pamięci podręcznej in-memory są prawidłowe"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -257,7 +253,7 @@ msgstr ""
 "Rozmiar (w megabajtach) tabeli danych przydzielonej w szybkiej pamięci "
 "podręcznej dla żądań passwd"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -265,7 +261,7 @@ msgstr ""
 "Rozmiar (w megabajtach) tabeli danych przydzielonej w szybkiej pamięci "
 "podręcznej dla żądań grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -273,7 +269,7 @@ msgstr ""
 "Rozmiar (w megabajtach) tabeli danych przydzielonej w szybkiej pamięci "
 "podręcznej dla żądań grup inicjacji"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -281,7 +277,7 @@ msgstr ""
 "Wartość tej opcji będzie używana podczas rozwijania opcji override_homedir, "
 "jeśli szablon zawiera ciąg formatowania %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -289,7 +285,7 @@ msgstr ""
 "Określa czas w sekundach, w którym lista poddomen będzie uważana za "
 "prawidłową."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -299,17 +295,17 @@ msgstr ""
 "w tle, jeśli są żądane poza procentem wartości entry_cache_timeout dla "
 "domeny."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Jak długo umożliwiać logowania w pamięci podręcznej między logowaniami "
 "w trybie online (dni)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Ile nieudanych prób zalogowania jest dozwolonych w trybie offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -317,90 +313,90 @@ msgstr ""
 "Ile czasu (minut) nie pozwalać na zalogowanie po osiągnięciu "
 "offline_failed_login_attempts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 "Jaki rodzaj komunikatów wyświetlać użytkownikowi podczas uwierzytelniania"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Filtruje odpowiedzi PAM wysłane do pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Ile sekund zatrzymać informacje o tożsamości w pamięci podręcznej dla żądań "
 "PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "Ile dni przed wygaśnięciem hasła wyświetlić ostrzeżenie"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Lista zaufanych UID lub nazw użytkowników"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "Lista domen dostępnych także dla niezaufanych użytkowników."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "Komunikat wyświetlany po wygaśnięciu konta użytkownika."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "Komunikat wyświetlany po zablokowaniu konta użytkownika."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Zezwala na uwierzytelnianie za pomocą certyfikatów/smartcard."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "Ścieżka do bazy danych certyfikatów z modułami PKCS#11."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 "Dostraja sprawdzanie poprawności certyfikatów przy uwierzytelnianiu PAM."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "Ile sekund pam_sss ma oczekiwać na ukończenie p11_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr "Które usługi PAM mają zezwolenie na kontakt z domenami aplikacji"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Usługi mogące używać kart smardcard"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Dodatkowy czas oczekiwania na kartę, jeśli zażądano"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "Adres URI PKCS#11 do ograniczenia wyboru urządzeń dla uwierzytelniania za "
 "pomocą kart smartcard"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "Kiedy program odpowiadający PAM ma wymuszać żądanie grup inicjacji"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "Lista usług PAM, które mogą się uwierzytelniać za pomocą GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "Czy dopasowywać uwierzytelnione UPN z użytkownikiem docelowym"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -408,29 +404,29 @@ msgstr ""
 "Lista par <usługa PAM>:<wskaźnik uwierzytelnienia>, które muszą być "
 "wymuszone dla dostępu PAM za pomocą uwierzytelniania GSSAPI"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Zezwala na uwierzytelnianie za pomocą urządzenia hasła-klucza."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "Ile sekund pam_sss ma oczekiwać na ukończenie passkey_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Włącza debugowanie w bibliotece libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "Czy sprawdzać atrybuty oparte na czasie w regułach sudo"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 "Jeśli jest włączone, usługa SSSD przełączy z powrotem do logiki kolejności "
 "„niższe wygrywa”"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -438,26 +434,26 @@ msgstr ""
 "Maksymalna liczba reguł, jaką można odświeżyć jednocześnie. Jeśli zostanie "
 "przekroczona, wykonywane jest pełne odświeżenie."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "Czy mieszać nazwy komputerów i adresy w pliku known_hosts"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 "Ile sekund przechowywać komputer w pliku known_hosts po zażądaniu jego kluczy"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Ścieżka do miejsca przechowywania zaufanych certyfikatów CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Zezwala na tworzenie kluczy SSH z certyfikatów"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -465,25 +461,25 @@ msgstr ""
 "Używa poniższych reguł dopasowania do filtrowania certyfikatów do tworzenia "
 "kluczy SSH"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Lista UID lub nazw użytkowników mających dostęp do programu odpowiadającego "
 "PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Jak długo dane PAC są uważane za prawidłowe"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Sprawdza poprawność PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Lista atrybutów użytkownika, które InfoPipe może publikować"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -494,7 +490,7 @@ msgstr ""
 "opcje użytkowników i grup są nagrywane. all — wszyscy użytkownicy są "
 "nagrywani."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -504,7 +500,7 @@ msgstr ""
 "sesji. Dopasowuje nazwy użytkowników zwracane przez NSS. Tzn. po możliwych "
 "zastąpieniach spacji, zmianach wielkości znaków itp."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -514,7 +510,7 @@ msgstr ""
 "sesji. Dopasowuje nazwy grup zwracane przez NSS. Tzn. po możliwych "
 "zastąpieniach spacji, zmianach wielkości znaków itp."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -522,7 +518,7 @@ msgstr ""
 "Lista użytkowników oddzielonych przecinkami do wykluczenia z nagrywania, "
 "tylko kiedy scope=all"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -530,103 +526,103 @@ msgstr ""
 "Lista grup oddzielonych przecinkami, których członkowie mają być wykluczeni "
 "z nagrywania, tylko kiedy scope=all. "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Dostawca tożsamości"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Dostawca uwierzytelniania"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Dostawca kontroli dostępu"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Dostawca zmiany hasła"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Dostawca SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Dostawca Autofs"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Dostawca tożsamości komputera"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "Dostawca SELinuksa"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Dostawca zarządzania sesją"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Dostawca programu rozwiązującego"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "Czy domena jest używalna przez system operacyjny lub aplikacje"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Włącza lub wyłącza domenę"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Minimalny identyfikator użytkownika"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Maksymalny identyfikator użytkownika"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Włącza wyliczanie wszystkich użytkowników/grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Dane uwierzytelniające pamięci podręcznej dla logowań w trybie offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Wyświetla użytkowników/grupy w pełni kwalifikowanej formie"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Bez dołączania członków grup w wyszukiwaniach grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Czas oczekiwania pamięci podręcznej wpisów (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Ogranicza lub preferuje podaną rodzinę adresów podczas wykonywania "
 "wyszukiwań DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Jak długo utrzymywać wpisy logowania w pamięci podręcznej po ostatnim udanym "
 "zalogowaniu (dni)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -634,125 +630,125 @@ msgstr ""
 "Jak długo SSSD ma komunikować się z jednym serwerem DNS przed spróbowaniem "
 "następnego serwera (milisekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "Jak długo próbować rozwiązać jedno zapytanie DNS (sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Jak długo czekać na odpowiedzi od serwera DNS podczas rozwiązywania serwerów "
 "(sekundy)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Część domeny zapytania DNS wykrywania usługi"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Zastępuje wartość GID z dostawcy tożsamości tą wartością"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Rozróżnianie wielkości liter w nazwach użytkowników"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Jak często odświeżać w tle wygasłe wpisy"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr "Maksymalny okres odchylenia podczas odświeżania wygasłych wpisów w tle"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Czy automatycznie aktualizować wpis DNS klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "TTL do zastosowania do wpisu DNS klienta po jego zaktualizowaniu"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "Interfejs, którego adres IP ma być używany do dynamicznych aktualizacji DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Jak często okresowo aktualizować wpis DNS klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Maksymalny okres odchylenia podczas aktualizowania wpisu DNS klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "Czy dostawca ma bezpośrednio aktualizować także wpis PTR"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Czy narzędzie nsupdate ma domyślnie używać portu TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Jakiego rodzaju uwierzytelnianie ma być używane do wykonywania aktualizacji "
 "DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "Zastępuje serwer DNS używany do wykonywania aktualizacji DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Kontrola wyliczania zaufanych domen"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Jak często odświeżać listę poddomen"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "Maksymalny okres odchylenia podczas odświeżania listy poddomen"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Lista opcji dziedziczonych przez poddomenę"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Domyślna wartość katalogu domowego poddomeny"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Jak długo dane uwierzytelniania w pamięci podręcznej mogą być używane do "
 "uwierzytelniania w pamięci podręcznej"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "Czy automatycznie tworzyć prywatne grupy dla użytkowników"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Wyświetla ostrzeżenie N dni przed wygaśnięciem hasła."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Różne etykiety przechowywane przez usługę konfiguracji realmd dla tej domeny."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -760,7 +756,7 @@ msgstr ""
 "Dostawca, który ma obsługiwać pobieranie poddomen. Ta wartość musi być "
 "zawsze taka sama co id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -768,7 +764,7 @@ msgstr ""
 "Ile sekund przechowywać klucz SSH komputera po odświeżeniu. Tzn. jak długo "
 "przechowywać klucz komputera w pamięci podręcznej."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -779,112 +775,112 @@ msgstr ""
 "pierwszego składnika uwierzytelnienia (hasło długoterminowe), aby został "
 "zapisany jako suma kontrolna SHA512 w pamięci podręcznej."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Zasady metod lokalnego uwierzytelniania "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Domena IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Adres serwera IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adres zapasowego serwera IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Nazwa komputera klienta IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "Czy automatycznie aktualizować wpis DNS klienta w oprogramowaniu FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Podstawa wyszukiwania pod kątem obiektów związanych z HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "Czas między wyszukiwaniami reguł HBAC w serwerze IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr "Czas w sekundach między wyszukiwaniami map SELinuksa w serwerze IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Jeśli ustawiono na fałsz, to parametr komputera podany przez PAM zostanie "
 "zignorowany"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "Położenie automountera, którego używa ten klient IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 "Podstawa wyszukiwania dla obiektów zawierających informacje o domenie IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 "Podstawa wyszukiwania dla obiektów zawierających informacje o zakresach "
 "identyfikatorów"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Włącza witryny DNS — wykrywanie usług na podstawie położenia"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Podstawa wyszukiwania dla widoku kontenerów"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Klasa obiektu dla widoku kontenerów"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Atrybut z nazwą widoku"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Klasa obiektu dla obiektów zastępowania"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Atrybut z odniesieniem do pierwotnego obiektu"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Klasa obiektu dla obiektów zastępowania użytkownika"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Klasa obiektów dla obiektów zastępowania grup"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Podstawa wyszukiwania pod kątem obiektów związanych z profilem pulpitu"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 "Czas w sekundach między wyszukiwaniami reguł profilu pulpitu w serwerze IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -892,42 +888,42 @@ msgstr ""
 "Czas w minutach między wyszukiwaniami reguł profilów pulpitu w serwerze IPA, "
 "kiedy ostatnie żądanie nie odnalazło żadnej reguły"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "Podstawa wyszukiwania dla zakresów SUBID"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Które reguły mają być używane do sprawdzania kontroli dostępu"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "Atrybut LDAP zawierający FQDN komputera."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "Klasa obiektów wpisu komputera w LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 "Używa podanego ciągu jako podstawę wyszukiwania dla obiektów komputera."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "Atrybut LDAP zawierający klucze publiczne SSH komputera."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "Atrybut LDAP zawierający nazwę domeny NIS grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "Atrybut LDAP zawierający nazwy członków grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -935,7 +931,7 @@ msgstr ""
 "Atrybut LDAP zawierający listę FQDN komputerów i grup komputerów będących "
 "członkami grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -943,11 +939,11 @@ msgstr ""
 "Atrybut LDAP zawierający listę komputerów i grup komputerów będących "
 "bezpośrednimi członkami grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "Atrybut LDAP zawierający listę członkostw grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -955,30 +951,30 @@ msgstr ""
 "Atrybut LDAP zawierający listę użytkowników i grup systemowych będących "
 "bezpośrednimi członkami grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "Atrybut LDAP odpowiadający nazwie grupy sieciowej."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "Klasa obiektów wpisu grupy sieciowej w LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "Atrybut LDAP zawierający UUID/GUID obiektu grupy sieciowej LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr "Atrybut LDAP określający, czy mapowanie użytkownika jest włączone."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "Atrybut LDAP kategorię komputera, taką jak „all”."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -986,18 +982,18 @@ msgstr ""
 "Atrybut LDAP zawierający wszystkie komputery/grupy komputerów, do których ta "
 "reguła pasuje."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "Atrybut LDAP zawierający wszystkich użytkowników/grupy, do których ta reguła "
 "pasuje."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "Atrybut LDAP zawierający nazwę mapy użytkownika SELinuksa."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -1005,19 +1001,19 @@ msgstr ""
 "Atrybut LDAP zawierający DN reguły HBAC, który można używać do dopasowywania "
 "zamiast memberUser i memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "Atrybut LDAP zawierający sam ciąg użytkownika SELinuksa."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "Atrybut LDAP kategorię użytkownika, taką jak „all”."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "Atrybut LDAP unikalny identyfikator mapy użytkownika."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1025,57 +1021,57 @@ msgstr ""
 "Opcja wskazuje, że usługa SSSD działa na serwerze IPA i ma wykonywać "
 "wyszukiwania użytkowników i grup z zaufanych domen w inny sposób."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "Używa podanego ciągu jako podstawę wyszukiwania dla zaufanych domen."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Domena Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Włączone domeny Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Adres serwera Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Adres zapasowego serwera Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Nazwa komputera klienta Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Filtr LDAP do określenia uprawnień dostępu"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Czy używać Global Catalog do wyszukiwań"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Tryb działania dla kontroli dostępu opartej na GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "Czas między wyszukiwaniami plików zasad GPO w serwerze AD"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 "Nazwy usług PAM mapujących do ustawień zasad GPO (Deny)InteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1083,290 +1079,290 @@ msgstr ""
 "Nazwy usług PAM mapujących do ustawień zasad GPO "
 "(Deny)RemoteInteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "Nazwy usług PAM mapujących do ustawień zasad GPO (Deny)NetworkLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr "Nazwy usług PAM mapujących do ustawień zasad GPO (Deny)BatchLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "Nazwy usług PAM mapujących do ustawień zasad GPO (Deny)ServiceLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 "Nazwy usług PAM, dla których zawsze udzielany jest dostęp oparty na GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 "Nazwy usług PAM, dla których zawsze odmawiany jest dostęp oparty na GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Domyślne uprawnienie logowania (lub zezwolenie/odmowa) do użycia dla "
 "niemapowanych nazw usług PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "konkretna strona używana przez klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Maksymalny wiek w dniach przed wymaganiem odnowienia hasła konta komputera"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Opcja dostrajania zadania odnawiania konta komputera"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr "Czy aktualizować hasło konta komputera w bazie danych Samby"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Używa portu LDAPS dla żądań LDAP i Global Catalog"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "Bez filtrowania grup lokalnej domeny z innych domen"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Adres serwera Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Adres zapasowego serwera Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Obszar Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Czas oczekiwania na uwierzytelnienie"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Czy tworzyć pliki kdcinfo"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Gdzie umieścić wstawki konfiguracji krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 "Katalog do przechowywania pamięci podręcznych danych uwierzytelniających"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Położenie pamięci podręcznej danych uwierzytelniających użytkownika"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Położenie tablicy kluczy do sprawdzania danych uwierzytelniających"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Włącza sprawdzanie danych uwierzytelniających"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "Przechowuje hasło, jeśli w trybie offline do późniejszego uwierzytelnienia "
 "w trybie online"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Odnawialny czas trwania TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Czas trwania TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Czas między dwoma sprawdzaniami odnowy"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Włącza FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Wybiera naczelnika do użycia dla FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "Używa anonimowego PKINIT do żądania danych uwierzytelniających FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Włącza ujednolicanie naczelnika"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Włącza naczelników enterprise"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Umożliwia korzystanie z obszarów poddomen do uwierzytelniania"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "Mapa nazw użytkowników do nazw naczelników Kerberos"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Serwer, w którym jest uruchomiona usługa zmiany haseł, jeśli nie znajduje "
 "się w KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, adres URI serwera LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, adres URI serwera LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Domyślna podstawowa DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Typ Schema do użycia na serwerze LDAP, RFC2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Tryb używany do zmiany hasła użytkownika"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Domyślne DN dowiązania"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Typ tokenu uwierzytelniania domyślnego DN dowiązania"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Token uwierzytelniania domyślnego DN dowiązania"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Czas do próby połączenia"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Czas do próby synchronicznych działań LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Czas między próbami ponownego połączenia w trybie offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Użycie tylko wielkich znaków w nazwach obszarów"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Plik zawierający certyfikaty CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Ścieżka do katalogu certyfikatów CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Plik zawierający certyfikat klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Plik zawierający klucz klienta"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Lista możliwych zestawów szyfrów"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Wymaga sprawdzenia certyfikatu TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Podaje używany mechanizm SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Podaje używany identyfikator upoważnienia SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Podaje obszar upoważnienia SASL do użycia"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Podaje minimalne SSF dla upoważnienia sasl LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "Podaje maksymalne SSF dla upoważnienia sasl LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Tablica kluczy usługi Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Używa uwierzytelniania Kerberos dla połączenia LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Podąża za odsyłaniami LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Czas trwania TGT dla połączenia LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Jak wskazywać aliasy"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Nazwa usługi do wyszukiwań usługi DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Liczba wpisów do pobrania w jednym zapytaniu LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr "Suma liczb, których musi brakować, aby wywołać pełne „deref”"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Ignoruje nieczytelne odniesienia LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1374,7 +1370,7 @@ msgstr ""
 "Czy biblioteka LDAP ma wykonywać odwrotne wyszukanie, aby ujednolicić nazwę "
 "komputera podczas dowiązania SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1382,30 +1378,36 @@ msgstr ""
 "Zezwala na zachowywanie lokalnych użytkowników jako członków grupy LDAP dla "
 "serwerów używających schematu RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "Atrybut entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "Atrybut lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "Jak długo utrzymywać połączenie z serwerem LDAP przed rozłączeniem"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Wyłącza kontrolę stronicowania LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Wyłącza pobieranie zakresu Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Czas oczekiwania na żądanie wyszukiwania"
@@ -2006,33 +2008,33 @@ msgstr "Ścieżka źródeł pliku „passwd”."
 msgid "Path of group file sources."
 msgstr "Ścieżka źródeł pliku „group”."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "Działanie indeksu się nie powiodło: %1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Uruchamia jako usługa (domyślnie)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Uruchamia interaktywnie (nie jako usługa)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Wyświetla numer wersji i kończy działanie"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -2040,97 +2042,97 @@ msgid ""
 "\n"
 msgstr "Działanie indeksu się nie powiodło: %1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "Opcja -i|--interactive nie jest dozwolona z opcją -D|--daemon\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Brak pamięci\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Zezwala na zrzuty core"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Otwiera deskryptor pliku dla dzienników debugowania"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "Użytkownik, jako który utworzyć ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Grupa, jako którą utworzyć ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "Używa anonimowego PKINIT do żądania opakowanego biletu FAST"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Używany obszar Kerberosa"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Żądany czas trwania biletu"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Żądany odnawialny czas trwania biletu"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "Opcje FAST („never”, „try”, „demand”)"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "Podaje naczelnika serwera używanego dla FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Żąda ujednolicenie nazwy naczelnika"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Użycie niestandardowej wersji krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "Identyfikator łańcucha tevent używany do celów zapisywania w dzienniku"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "Sprawdza flagi PAC"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf się nie powiodło.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd się nie powiodło.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domena dostawcy informacji (wymagane)"
 
@@ -2164,66 +2166,66 @@ msgstr "Wystąpił błąd, ale nie odnaleziono jego opisu."
 msgid "Unexpected error while looking for an error description"
 msgstr "Nieoczekiwany błąd podczas wyszukiwania opisu błędu"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Odmowa uprawnienia. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Komunikat serwera: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 "TGT Kerberosa nie będzie nadawany po zalogowaniu, co wpłynie na użytkownika."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "Proszę podać kod PIN:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Hasła się nie zgadzają"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Przywrócenie hasła przez użytkownika root nie jest obsługiwane."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Uwierzytelniono za pomocą danych z pamięci podręcznej"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", hasło w pamięci podręcznej wygaśnie za: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Hasło wygasło. Pozostało %1$d możliwych logowań."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Hasło wygaśnie za %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Hasło wygasło."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Uwierzytelnianie jest zabronione do: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "System jest w trybie offline, zmiana hasła nie jest możliwa"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2231,11 +2233,11 @@ msgstr ""
 "Po zmianie hasła OTP należy się wylogować i zalogować ponownie, aby uzyskać "
 "bilet"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "Zablokowano kod PIN"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2243,69 +2245,69 @@ msgstr ""
 "Nie nadano TGT Kerberosa, jako że serwer nie obsługuje tej metody, co "
 "wpłynie na pojedyncze logowanie (SSO)."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Zmiana hasła się nie powiodła. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "Proszę uwierzytelnić pod adresem %1$s i nacisnąć klawisz Enter."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 "Proszę uwierzytelnić za pomocą kodu PIN %1$s pod adresem %2$s i nacisnąć "
 "klawisz Enter."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "Proszę (ponownie) włożyć (inną) kartę smartcard"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nowe hasło: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Proszę ponownie podać nowe hasło: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Pierwszy czynnik: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Drugi czynnik (opcjonalnie): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Drugi czynnik: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 "Proszę włożyć urządzenie hasła-klucza, a następnie nacisnąć klawisz Enter."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Hasło: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Pierwszy czynnik (obecne hasło): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Bieżące hasło: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Hasło wygasło. Proszę je zmienić teraz."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Poziom debugowania, z jakim uruchomić"
 
@@ -2314,7 +2316,7 @@ msgstr "Poziom debugowania, z jakim uruchomić"
 msgid "The SSSD domain to use"
 msgstr "Używana domena SSSD"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Błąd podczas ustawiania lokalizacji\n"
 
@@ -2376,85 +2378,89 @@ msgstr "sss_ssh_knownhostsproxy: połączenie z komputerem %s na porcie %d: %s\
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: nie można rozwiązać nazwy komputera %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Żaden obiekt pamięci podręcznej nie pasuje do podanego wyszukiwania\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "Nie można unieważnić %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "Nie można unieważnić %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Unieważnia wszystkie wpisy w pamięci podręcznej"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Unieważnia podanego użytkownika"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Unieważnia wszystkich użytkowników"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Unieważnia podaną grupę"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Unieważnia wszystkie grupy"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Unieważnia podaną grupę sieciową"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Unieważnia wszystkie grupy sieciowe"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Unieważnia podaną usługę"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Unieważnia wszystkie usługi"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Unieważnia podaną mapę autofs"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Unieważnia wszystkie mapy autofs"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Unieważnia konkretny komputer SSH"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Unieważnia wszystkie komputery SSH"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Unieważnia podaną regułę sudo"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Unieważnia wszystkie reguły sudo w pamięci podręcznej"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Unieważnia wpisy tylko z podanej domeny"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2462,11 +2468,11 @@ msgstr ""
 "Podano nieoczekiwane parametry, opcje unieważniające jeden obiekt przyjmują "
 "tylko jeden podany parametr.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Proszę wybrać co najmniej jeden obiekt do unieważnienia\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2476,7 +2482,7 @@ msgstr ""
 "domeną), należy użyć w pełni kwalifikowanej nazwy zamiast parametru --"
 "domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Nie można otworzyć dostępnych domen\n"
 
@@ -2510,164 +2516,164 @@ msgstr "Nie można odczytać wejścia użytkownika\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Nieprawidłowe wejście, proszę podać „%s” lub „%s”.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Błąd podczas wykonywania polecenia zewnętrznego\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Błąd podczas wykonywania zewnętrznego polecenia „%s”\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "Polecenie „%s” się nie powiodło z [%d]\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "Usługa SSSD musi być uruchomiona. Uruchomić ją teraz?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "Usługa SSSD nie może być uruchomiona. Zatrzymać ją teraz?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "Usługa SSSD musi zostać ponownie uruchomiona. Zrobić to teraz?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "Stan usługi SSSD:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Wyświetla listę dostępnych domen"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Wyświetla informacje o domenie"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "Wyświetla informacje o użytkowniku i sprawdza uwierzytelnienie"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Tworzy raport dostępu domeny"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Informacje o treści w pamięci podręcznej:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Informacje o użytkowniku w pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Informacje o grupie w pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Informacje o grupie sieciowej w pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Narzędzia lokalnych danych:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Tworzy kopię zapasową lokalnych danych"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Przywraca lokalne dane z kopii zapasowej"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 "Tworzy kopię zapasową lokalnych danych i usuwa treści w pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Unieważnia obiekty w pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Zarządza indeksami pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Narzędzia plików dziennika:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Usuwa istniejące pliki dziennika SSSD"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "Archiwizuje pliki dziennika SSSD w pliku tar"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "Zmienia lub wyświetla informacje o poziomie debugowania usługi SSSD"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Analizuje dane zapisane w dzienniku"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Narzędzia plików konfiguracji:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "Wykonuje analizę statyczną konfiguracji usługi SSSD"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Narzędzia związane z certyfikatami:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Wyświetla informacje o certyfikacie"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Wyświetla użytkowników mapowanych do certyfikatu"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Sprawdza regułę mapowania i dopasowania z certyfikatem"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 #, fuzzy
 msgid "GPOs related tools:"
 msgstr "Narzędzia związane z hasłami-kluczami:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Informacje o użytkowniku w pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Narzędzia związane z hasłami-kluczami:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "Wykonuje rejestrację hasłem-kluczem"
 
@@ -2722,7 +2728,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Błąd: nie można uzyskać obiektu [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: nie można odczytać wartości [%d]: %s\n"
@@ -2736,218 +2742,218 @@ msgstr "Należy podać nazwę."
 msgid "Unable to parse name %s.\n"
 msgstr "Nie można przetworzyć nazwy %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Wyszukuje według SID"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Wyszukuje według identyfikatorów użytkowników"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Czas wygaśnięcia grup inicjacji"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Wyszukuje według identyfikatorów grup"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 #, fuzzy
 msgid "Search by GPO guid"
 msgstr "Wyszukuje według identyfikatorów grup"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, fuzzy, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Nie można przetworzyć parametrów polecenia\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, fuzzy, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Odczytanie „%s” się nie powiodło: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 #, fuzzy
 msgid "talloc failed\n"
 msgstr "malloc się nie powiodło.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 #, fuzzy
 msgid "Unable to get attribute list!\n"
 msgstr "Nie można uzyskać listy serwerów\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "Nie można usunąć plików pamięci podręcznej\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 #, fuzzy
 msgid "Unable to get GPOs base DN\n"
 msgstr "Nie można uzyskać listy serwerów\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, fuzzy, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Nie można zarchiwizować plików dziennika\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, fuzzy, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "Nie można połączyć się z magistralą systemową.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, fuzzy, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Nie można usunąć plików dziennika\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, fuzzy, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Odczytanie „%s” się nie powiodło: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "Nie można otworzyć dostępnych domen\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, fuzzy, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Odczytanie „%s” się nie powiodło: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Wyświetla informacje debugowania"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "Podaje certyfikat zakodowany w Base64."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "Nie można połączyć się z magistralą systemową.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " — nie odnaleziono mapowanych użytkowników —"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "Reguła mapowania"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Reguła dopasowania"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Nie można przetworzyć parametrów polecenia\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Brak pamięci.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Konfiguracja kontekstu mapy certyfikatów się nie powiodła.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "Dodanie reguł mapowania i dopasowania nie powiodło się z błędem [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Odkodowanie ciągu Base64 się nie powiodło.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Certyfikat pasuje do reguły.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Certyfikat nie pasuje do reguły.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "Błąd podczas dopasowywania certyfikatu [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "Utworzenie filtru mapowania [%d][%s] się nie powiodło.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2960,7 +2966,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2971,35 +2977,35 @@ msgstr ""
 "„/moja/ścieżka/sssd.conf”, to używany jest katalog wstawek „/moja/ścieżka/"
 "conf.d”)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "Plik %1$s nie istnieje.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "Nie ma konfiguracji.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Odczytanie „%s” się nie powiodło: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Uruchomienie programów sprawdzających poprawność się nie powiodło"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Problemy zidentyfikowane przez programy sprawdzające poprawność: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Komunikaty utworzone podczas łączenia konfiguracji: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Użyte pliki wstawek konfiguracji: %zu\n"
@@ -3021,102 +3027,102 @@ msgstr "Nie można wyeksportować zastąpień użytkownika\n"
 msgid "Unable to export group overrides\n"
 msgstr "Nie można wyeksportować zastąpień grupy\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Zastępuje istniejącą kopię zapasową"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Nie można zaimportować zastąpień użytkownika\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Nie można zaimportować zastąpień grupy\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Uruchamia usługę SSSD, jeśli nie jest uruchomiona"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Ponownie uruchamia usługę SSSD po imporcie danych"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Tworzy czyste pliki pamięci podręcznej i importuje lokalne dane"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Zatrzymuje usługę SSSD przed usunięciem pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Uruchamia usługę SSSD po usunięciu pamięci podręcznej"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Tworzenie kopii zapasowej lokalnych danych…\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "Nie można utworzyć kopii zapasowej lokalnych danych, nie można usunąć "
 "pamięci podręcznej.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Usuwanie plików pamięci podręcznej…\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Nie można usunąć plików pamięci podręcznej\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Przywracanie lokalnych danych…\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "Tworzenie indeksu pamięci podręcznej dla domeny %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "Usuwanie indeksu pamięci podręcznej dla domeny %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "Indeksy dla domeny %1$s:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Atrybut: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Działa na podanej domenie"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "domena"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Atrybut do indeksowania"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "atrybut"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "Nie podano działania\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3125,181 +3131,181 @@ msgstr ""
 "Nieznane działanie: %1$s\n"
 "Prawidłowe działania: „%2$s”, „%3$s” i „%4$s”\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Nie podano atrybutu (-a)\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "Atrybut %1$s nie jest indeksowany.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "Atrybut %1$s jest już indeksowany.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Działanie indeksu się nie powiodło: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 "Nie należy zapomnieć zaktualizować indeksów także na zdalnych dostawcach.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr "Wyświetla listę domen, w tym główny i zaufany typ domeny"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "Online"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Offline"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Stan online: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "Ta domena nie ma aktywnych serwerów.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Aktywne serwery:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "nie połączono"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Nie wykryto żadnych serwerów.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "Wykryte serwery (%s):\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Jeszcze nic.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Wyświetla stan online"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Wyświetla informacje o aktywnym serwerze"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Wyświetla listę wykrytych serwerów"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Należy podać nazwę domeny."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Nie można uzyskać stanu online\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Nie można uzyskać listy serwerów\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "Usługa SSSD nie jest uruchomiona.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Nieznana domena\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Nie można połączyć się z usługą\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Usuwa pliki dziennika zamiast ich skracania"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Usuwanie plików dziennika…\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Nie można usunąć plików dziennika\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Skracanie plików dziennika…\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Nie można skrócić plików dziennika\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Archiwizowanie plików dziennika w %s…\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Nie można zarchiwizować plików dziennika\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "Działa na usłudze SSSD"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "Działa na usłudze NSS"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "Działa na usłudze PAM"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "Działa na usłudze sudo"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "Działa na usłudze Autofs"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "Działa na usłudze SSH"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "Działa na usłudze PAC"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "Działa na usłudze IFP"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Podaje poziom debugowania do ustawienia"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "BŁĄD: brak obsługi identyfikatora łańcucha tevent, analizator dziennika jest "
@@ -3366,19 +3372,19 @@ msgstr ""
 " — powłoka: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "Działanie PAM [auth|acct|setc|chau|open|clos], domyślnie: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "Usługa PAM, domyślnie: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Należy podać nazwę użytkownika."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3391,22 +3397,22 @@ msgstr ""
 "usługa: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "Wyszukanie nazwy użytkownika [%s] się nie powiodło.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "InfoPipe Wyszukanie użytkownika z [%s] się nie powiodło.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start się nie powiodło: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3414,12 +3420,12 @@ msgstr ""
 "testowanie pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item się nie powiodło: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3428,7 +3434,7 @@ msgstr ""
 "pam_authenticate dla użytkownika [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3436,7 +3442,7 @@ msgstr ""
 "testowanie pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3445,7 +3451,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3453,7 +3459,7 @@ msgstr ""
 "testowanie pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3462,7 +3468,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3470,7 +3476,7 @@ msgstr ""
 "testowanie pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3479,7 +3485,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3487,7 +3493,7 @@ msgstr ""
 "testowanie pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3496,7 +3502,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3504,7 +3510,7 @@ msgstr ""
 "testowanie pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3513,26 +3519,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "nieznane działanie\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "Środowisko PAM:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " — brak środowiska —\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Podaje niedomyślny plik konfiguracji"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Informuje, że program odpowiadający został aktywowany gniazdem"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Liczba prób połączenia do dostawców danych"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Wyłącza interfejs netlink"
 
diff --git a/po/pt.po b/po/pt.po
index d6e3b7a30c3..ebc37e03dcd 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:47-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Portuguese (http://www.transifex.com/projects/p/sssd/language/"
@@ -45,26 +45,22 @@ msgid "Command to start service"
 msgstr "Comando para iniciar serviço"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Número de vezes para tentar ligação aos Fornecedores de Dados"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -72,63 +68,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Serviços SSSD a iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Domínios SSSD a iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Expressão regular para obter nome do utilizar e domínio"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Formato compatível com o printf para apresentar nomes completos"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -136,136 +132,136 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Validade da cache de enumeração (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Validade da actualização da cache em segundo plano (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Validade da cache negativa (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Utilizadores que o SSSD devem explicitamente ignorar"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Grupos que o SSSD devem explicitamente ignorar"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Devem os utilizadores filtrados aparecer em grupos"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "O valor do campo da senha que o fornecedor NSS deve retornar"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Durante quanto tempo devem ser permitidas as caches de sessões entre sessões "
 "online (dias)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 "Quantas tentativas falhadas de inicio de sessão são permitidas quando offline"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -273,1007 +269,1013 @@ msgstr ""
 "Quanto tempo (minutos) para negar a sessão após "
 "offline_failed_login_attempts ter sido atingido"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Obriga a verificação de certificados TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Fornecedor de identidade"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Fornecedor de autenticação"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Fornecedor de controle de acesso"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Fornecedor de Alteração de Senha"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "Activar validação de credenciais"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "ID de utilizador mínimo"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "ID de utilizador máximo"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Permitir enumeração de todos os utilizadores/grupos"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Efectuar cache de credenciais para sessões em modo desligado"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Apresentar utilizadores/grupos na forma completa"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Validade da cache (segundos)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Restringir ou preferir famílias de endereços especificas quando efectua "
 "consultas DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Durante quanto tempo devem ser permitidas as caches de sessões entre sessões "
 "bem sucedidas (dias)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Domínio IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Endereço do servidor IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Nome da máquina do cliente IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Endereço do servidor Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Reino Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Tempo de expiração da autenticação"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Directório para armazenar as caches de credenciais"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Localização da cache de credenciais dos utilizadores"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Localização da tabela de chaves (keytab) para validar credenciais"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Activar validação de credenciais"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Servidor onde está em execução o serviço de alteração de senha, se não "
 "coincide com o KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, O URI do servidor LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "A base DN por omissão"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "O tipo de Schema em utilização no servidor LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "O DN por omissão para a ligação"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "O tipo de token de autenticação do bind DN por omissão"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "O token de autenticação do bind DN por omissão"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Período de tempo para tentar ligação"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Tempo de espera para tentar operações LDAP síncronas"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Tempo de espera entre tentativas para re-conectar quando desligado"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Ficheiro que contêm os certificados CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Caminho para o directório do certificado CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Obriga a verificação de certificados TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Especificar mecanismo sasl a utilizar"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Especifique o id sasl para utilizar na autorização"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Separador chave do serviço Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Utilizar autenticação Kerberos para ligações LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Seguir os referrals LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Tempo de espera por um pedido de pesquisa"
@@ -1858,32 +1860,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Tornar-se num serviço (omissão)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Executar interactivamente (não como serviço)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1891,97 +1893,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Memória esgotada\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Um descritor de ficheiro aberto para os registos de depuração"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domínio do fornecedor de informação (obrigatório)"
 
@@ -2013,140 +2015,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Mensagem do Servidor: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Senhas não coincidem"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", a sua senha guardada em cache irá expirar em: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr ", a sua senha guardada em cache irá expirar em: "
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "O sistema está offline, a mudança de senha não é possível"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Alteração da senha falhou."
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nova Senha: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Digite a senha novamente: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Senha: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Senha actual: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "A senha expirou. Altere a sua senha agora."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "O nível de depuração a utilizar durante a execução"
 
@@ -2155,7 +2157,7 @@ msgstr "O nível de depuração a utilizar durante a execução"
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Erro ao definir a configuração regional\n"
 
@@ -2217,102 +2219,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2346,163 +2352,163 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "Incapaz de obter informação acerca do utilizador\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "Incapaz de obter informação acerca do utilizador\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2557,7 +2563,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2571,211 +2577,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2784,42 +2790,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2841,283 +2847,283 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "Domínio IPA"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "Atributo UID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "Fornecedor de autenticação"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3180,19 +3186,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3201,124 +3207,127 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Especificar um ficheiro de configuração não standard"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Número de vezes para tentar ligação aos Fornecedores de Dados"
+
 #~ msgid "Timeout for messages sent over the SBUS"
 #~ msgstr "Limite de tempo para mensagens enviadas sobre SBUS"
 
diff --git a/po/pt_BR.po b/po/pt_BR.po
index 746132e999b..0b26546d4bf 100644
--- a/po/pt_BR.po
+++ b/po/pt_BR.po
@@ -3,7 +3,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2015-10-27 08:15-0400\n"
 "Last-Translator: Marco Aurélio Krause <ouesten@me.com>\n"
 "Language-Team: Portuguese (Brazil)\n"
@@ -40,26 +40,22 @@ msgid "Command to start service"
 msgstr "Comando para iniciar o serviço"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -67,63 +63,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Serviços SSSD para iniciar"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -131,1131 +127,1137 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1839,32 +1841,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1872,97 +1874,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -1994,140 +1996,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2136,7 +2138,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2198,102 +2200,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2327,161 +2333,161 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2535,7 +2541,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2549,211 +2555,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2762,42 +2768,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2819,280 +2825,280 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3155,19 +3161,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3176,121 +3182,121 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
diff --git a/po/ru.po b/po/ru.po
index 8fc611d8479..37702f06f98 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-06-27 05:36+0000\n"
 "Last-Translator: Elena Mishina <lepata@basealt.ru>\n"
 "Language-Team: Russian <https://translate.fedoraproject.org/projects/sssd/"
@@ -51,26 +51,22 @@ msgid "Command to start service"
 msgstr "Команда для запуска службы"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Количество попыток подключения к поставщикам данных"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "Количество файловых дескрипторов, которые может открыть этот ответчик"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Время простоя до автоматического отсоединения клиента"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Время простоя до автоматического отключения ответчика"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "Всегда опрашивать все кэши перед опросом поставщиков данных"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -82,23 +78,23 @@ msgstr ""
 "проведённым без подключения. Это значение измеряется в секундах и "
 "вычисляется по формуле: offline_timeout + random_offset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Запускаемые службы SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Запускаемые домены SSSD"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Регулярное выражение для разбора имени пользователя и домена"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Printf-совместимый формат для отображения полностью определённых имён"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -106,36 +102,36 @@ msgstr ""
 "Каталог файловой системы, в котором SSSD следует сохранять файлы кэша "
 "повтора Kerberos."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Домен для имён без указанного компонента домена."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Пользователь, чьи привилегии будут использоваться"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Настроить проверку сертификатов"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Все пробелы в именах пользователей и групп будут заменены этим символом"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "Настроить sssd на учёт или игнорирование изменений состояния netlink"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Включить или отключить домен неявных файлов"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Порядок доменов, в котором их следует использовать для поиска"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -144,7 +140,7 @@ msgstr ""
 "определения момента, когда требуется обновить данные встроенного "
 "сопоставителя DNS."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -156,83 +152,83 @@ msgstr ""
 "этого используется inotify. Если невозможно использовать inotify, опрос "
 "resolv.conf будет выполняться каждые пять секунд."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "Автоматически запускать ответчик PAC для поставщиков AD и IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "Включить или отключить дампы памяти для всех процессов SSSD."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Настроить проверку ключа доступа"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Тайм-аут кэша перечисления (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Тайм-аут фонового обновления кэша записей (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Отрицательный тайм-аут кэша (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Отрицательный тайм-аут кэша файлов (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Пользователи, которых SSSD следует явно игнорировать"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Группы, которые SSSD следует явно игнорировать"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Должны ли отфильтрованные пользователи появляться в группах"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Значение поля пароля, которое должен вернуть поставщик NSS"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Переопределять значение домашнего каталога от поставщика учётных данных этим "
 "значением"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Заменять пустое значение домашнего каталога от поставщика учётных данных "
 "этим значением"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 "Переопределять значение командной оболочки от поставщика учётных данных этим "
 "значением"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 "Список командных оболочек, с которыми пользователям разрешён вход в систему"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 "Список командных оболочек, которые будут ветированы и заменены запасной "
 "оболочкой"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -240,16 +236,16 @@ msgstr ""
 "Если командная оболочка из центрального каталога разрешена, но не доступна, "
 "использовать эту как запасную"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 "Оболочка, которая будет использоваться, если поставщиком оболочка не указана"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Насколько долго записи кэша в памяти будут оставаться действительными"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -257,7 +253,7 @@ msgstr ""
 "Размер (в мегабайтах) таблицы данных, которая размещена в быстром кэше в "
 "памяти для запросов passwd"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -265,7 +261,7 @@ msgstr ""
 "Размер (в мегабайтах) таблицы данных, которая размещена в быстром кэше в "
 "памяти для запросов group"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -273,7 +269,7 @@ msgstr ""
 "Размер (в мегабайтах) таблицы данных, которая размещена в быстром кэше в "
 "памяти для запросов групп инициализации"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -281,7 +277,7 @@ msgstr ""
 "Значение этого параметра будет использоваться в расширении параметра "
 "override_homedir, если шаблон содержит строку формата %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -289,7 +285,7 @@ msgstr ""
 "Указывает время в секундах, в течение которого список поддоменов считается "
 "действительным."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -299,17 +295,17 @@ msgstr ""
 "фоновомрежиме, если запрос о них поступает позже срока, определённого в "
 "процентах от значенияentry_cache_timeout для домена."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Разрешённый интервал кэшированных входов между интерактивными входами (в "
 "днях)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Разрешённое количество неудачных попыток неинтерактивного входа"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -317,104 +313,104 @@ msgstr ""
 "Временной интервал (в минутах), в течение которого будет запрещён вход после "
 "достижения offline_failed_login_attempts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 "Какие сообщения будут показаны пользователю во время проверки подлинности"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Фильтровать ответы PAM, отправленные pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Разрешённое количество секунд, в течение которого данные идентификации "
 "хранятся в кэше для запросов PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 "Разрешённое количество дней до показа предупреждения об истечении срока "
 "действия пароля"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Список доверенных UID или имён пользователей"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "Список доменов, доступных даже для недоверенных пользователей."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 "Сообщение, которое выводится при истечении срока действия учётной записи "
 "пользователя."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 "Сообщение, которое выводится при блокировке учётной записи пользователя."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Разрешить проверку подлинности на основе сертификата или смарт-карты."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "Путь к базе данных сертификатов с модулями PKCS#11."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 "Настроить проверку сертификатов для проверки подлинности с помощью PAM."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 "Разрешённое количество секунд, в течение которого pam_sss ожидает завершения "
 "работы p11_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 "Указывает, каким службам PAM разрешено устанавливать соединение с доменами "
 "приложений"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Разрешённые службы для использования смарт-карт"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Дополнительный тайм-аут для ожидания карты в случае запроса"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "URI PKCS#11 для ограничения перечня устройств с проверкой подлинности по "
 "смарт-карте"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 "Когда ответчику PAM следует принудительно выполнять запрос групп "
 "инициализации"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 "Список служб PAM, которым разрешена проверка подлинности с помощью GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 "Следует ли устанавливать соответствие имени участника-пользователя (UPN), "
 "прошедшего проверку подлинности, целевому пользователю"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -423,33 +419,33 @@ msgstr ""
 "быть принудительно установлен доступ PAM с проверкой подлинности с помощью "
 "GSSAPI"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Разрешить проверку подлинности на основе ключа доступа."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 "Разрешённое количество секунд, в течение которого pam_sss ожидает завершения "
 "работы passkey_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Включить отладку в библиотеке libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 "Следует ли обрабатывать связанные с временными ограничениями атрибуты правил "
 "sudo"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 "Если значение «true», SSSD вернётся к логике упорядочивания «побеждает самое "
 "низкое»"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -457,11 +453,11 @@ msgstr ""
 "Максимальное количество правил, которые можно обновить одновременно. Если "
 "это количество превышено, будет выполнено полное обновление."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "Следует ли хэшировать имена и адреса узлов в файле known_hosts"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -469,15 +465,15 @@ msgstr ""
 "Разрешённое количество секунд, в течение которого узел хранится в файле "
 "known_hosts после запроса ключей этого узла"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Путь к хранилищу доверенных сертификатов CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Разрешить генерировать ключи SSH из сертификатов"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -485,24 +481,24 @@ msgstr ""
 "Использовать следующие правила установления соответствия при фильтрации "
 "сертификатов для создания ключей SSH"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Список UID или имён пользователей, которым разрешён доступ к ответчику PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Как долго данные PAC будут считаться действительными"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Проверить PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Список атрибутов пользователя, которые разрешено публиковать InfoPipe"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -513,7 +509,7 @@ msgstr ""
 "группы,которые указаны параметрами users и groups; all — записывать всех "
 "пользователей."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -524,7 +520,7 @@ msgstr ""
 "возвращённым NSS, то есть после возможной замены пробелов, смены регистра и "
 "так далее."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -534,7 +530,7 @@ msgstr ""
 "сеансов. Соответствие списку устанавливается по именам групп, возвращённым "
 "NSS, то есть после возможной замены пробелов, смены регистра и так далее."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -542,7 +538,7 @@ msgstr ""
 "Разделённый запятыми список пользователей, которые исключаются из записи; "
 "только если scope=all"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -550,103 +546,103 @@ msgstr ""
 "Разделённый запятыми список групп, участники которых исключаются из записи; "
 "только если scope=all. "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Поставщик данных для идентификации"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Поставщик данных для проверки подлинности"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Поставщик данных для контроля доступа"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Поставщик операции смены пароля"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Поставщик данных SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Поставщик данных Autofs"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Поставщик данных для идентификации узла"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "Поставщик данных SELinux"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Поставщик данных управления сеансами"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Поставщик данных сопоставителя"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "Определяет, может ли домен использоваться ОС или приложениями"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Включить или отключить домен"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Минимальный ID пользователя"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Максимальный ID пользователя"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Включить перечисление всех пользователей/групп"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Кэшировать учётные данные для неинтерактивного входа"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Отображать пользователей/группы в полной форме"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Не включать участников группы при поиске групп"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Тайм-аут кэша записей (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Ограничивать или предпочитать определённое семейство адресов при выполнении "
 "запросов DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Как долго хранить кэшированные записи после последнего успешного входа (в "
 "днях)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -654,20 +650,20 @@ msgstr ""
 "Как долго SSSD следует пытаться обменяться данными с одним сервером DNS "
 "перед переходом к следующему (в миллисекундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "Как долго следует пытаться разрешить один запрос DNS (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Время ожидания ответа DNS при преобразовании имён серверов (в секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Доменная часть DNS-запроса поиска служб"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -677,109 +673,109 @@ msgstr ""
 "попыткой повторного подключения к основному серверу после успешного "
 "подключения к резервному серверу"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 "Переопределять значение GID от поставщика учётных данных этим значением"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Обрабатывать имена пользователей с учётом регистра"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 "Как часто следует выполнять фоновое обновление записей с истекшим сроком "
 "действия"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 "Максимальное отклонение периода при обновлении просроченных записей в "
 "фоновом режиме"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Определяет, следует ли автоматически обновлять запись DNS клиента"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "TTL для применения к записи DNS клиента после её обновления"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "Интерфейс, адрес которого будет использован для обновления DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Частота периодического обновления записи DNS клиента"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Максимальное отклонение периода при обновлении записи DNS клиента"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "Следует ли поставщику данных также явно обновлять запись PTR"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Следует ли утилите nsupdate по умолчанию использовать TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Какая проверка подлинности должна использоваться для выполнения обновления "
 "DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 "Переопределить сервер DNS, который используется для выполнения обновления DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Управление перечислением доверенных доменов"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Как часто следует обновлять список поддоменов"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "Максимальное отклонение периода при обновлении списка поддоменов"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Список параметров, которые должны быть унаследованы в поддомене"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Стандартное значение домашнего каталога для поддоменов"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Как долго можно использовать кэшированные учётные данные для проверки "
 "подлинности с использованием кэша"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "Следует ли автоматически создавать закрытые группы для пользователей"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Показать предупреждение за N дней до истечения срока действия пароля."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Различные метки, сохранённые службой настройки realmd для этого домена."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -787,7 +783,7 @@ msgstr ""
 "Поставщик данных, который должен обрабатывать получение данных поддоменов. "
 "Это значение всегда должно совпадать со значением id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -796,7 +792,7 @@ msgstr ""
 "обновления. Иными словами, параметр определяет длительность хранения ключа "
 "узла в кэше."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -807,40 +803,40 @@ msgstr ""
 "фактора проверки подлинности (долговременного пароля), который должен быть "
 "сохранён в формате контрольной суммы SHA512 в кэше."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Локальная политика методов проверки подлинности "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Домен IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Адрес сервера IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Адрес резервного сервера IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Имя узла клиента IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "Следует ли автоматически обновлять запись DNS клиента во FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "База поиска объектов, связанных с HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "Временной интервал между сеансами поиска правил HBAC на сервере IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
@@ -848,63 +844,63 @@ msgstr ""
 "Временной интервал (в секундах) между сеансами поиска карт SELinux на "
 "сервере IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Если установлено значение «false», предоставленный PAM атрибут узла будет "
 "проигнорирован"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 "Расположение автоматического монтирования, которое использует этот клиент IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "База поиска объекта, содержащего информацию о домене IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "База поиска объектов, содержащих информацию о диапазонах ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Включить сайты DNS — обнаружение служб по расположению"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "База поиска контейнеров просмотра"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Класс объектов для контейнеров просмотра"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Атрибут с именем представления"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Класс объектов для объектов переопределения"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Атрибут со ссылкой на исходный объект"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Класс объектов для объектов переопределения пользователей"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Класс объектов для объектов переопределения групп"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "База поиска объектов, связанных с профилями рабочего стола"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -912,7 +908,7 @@ msgstr ""
 "Временной интервал (в секундах) между сеансами поиска правил профилей "
 "рабочего стола на сервере IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -921,42 +917,42 @@ msgstr ""
 "рабочего стола на сервере IPA, если во время последнего запроса не было "
 "найдено ни одного правила"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "База поиска для диапазонов SUBID"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 "Правила, которые используются, чтобы определить достаточность прав доступа"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "Атрибут LDAP, который содержит FQDN узла."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "Класс объектов записи узла в LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "Использовать указанную строку как базу поиска объектов узлов."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "Атрибут LDAP, который содержит открытые ключи SSH узла."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "Атрибут LDAP, который содержит имя домена NIS сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "Атрибут LDAP, который содержит имена участников сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -964,7 +960,7 @@ msgstr ""
 "Атрибут LDAP со списком FQDN узлов и групп узлов, которые являются "
 "участниками сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -972,11 +968,11 @@ msgstr ""
 "Атрибут LDAP со списком узлов и групп узлов, которые являются "
 "непосредственными участниками сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "Атрибут LDAP со списком участников сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -984,20 +980,20 @@ msgstr ""
 "Атрибут LDAP со списком общесистемных пользователей и групп, которые "
 "являются непосредственными участниками сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "Атрибут LDAP, соответствующий имени сетевой группы."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "Класс объектов записи сетевой группы в LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "Атрибут LDAP, который содержит UUID/GUID объекта сетевой группы LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -1005,11 +1001,11 @@ msgstr ""
 "Атрибут LDAP, который определяет, включена ли эта карта пользователей для "
 "использования."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "Атрибут LDAP, который содержит категорию узла (например, «all»)."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -1017,18 +1013,18 @@ msgstr ""
 "Атрибут LDAP, который содержит все узлы или группы узлов, для которых "
 "устанавливается соответствие этого правила."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "Атрибут LDAP, который содержит всех пользователей или группы, для которых "
 "устанавливается соответствие этого правила."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "Атрибут LDAP, который содержит имя карты пользователей SELinux."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -1036,20 +1032,20 @@ msgstr ""
 "Атрибут LDAP, который содержит DN правила HBAC, которое можно использовать "
 "для установления соответствия вместо memberUser и memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "Атрибут LDAP, который содержит саму строку пользователя SELinux."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 "Атрибут LDAP, который содержит категорию пользователя (например, «all»)."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "Атрибут LDAP, который содержит уникальный ID карты пользователей."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1057,51 +1053,51 @@ msgstr ""
 "Параметр обозначает, что SSSD работает на сервере IPA и следует иначе "
 "выполнять поиск пользователей и групп из доверенных доменов."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "Использовать указанную строку как базу поиска доверенных доменов."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Домен Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Включённые домены Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Адрес сервера Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Адрес резервного сервера Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Имя узла клиента Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Фильтр LDAP для определения прав доступа"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Следует ли использовать глобальный каталог для поиска"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Режим работы для управления доступом на основе GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 "Временной интервал между сеансами поиска файлов политики GPO на сервере AD"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
@@ -1109,7 +1105,7 @@ msgstr ""
 "Имена служб PAM, которые сопоставляются параметрам политики GPO "
 "(Deny)InteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1117,295 +1113,295 @@ msgstr ""
 "Имена служб PAM, которые сопоставляются параметрам политики GPO "
 "(Deny)RemoteInteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "Имена служб PAM, которые сопоставляются параметрам политики GPO "
 "(Deny)NetworkLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "Имена служб PAM, которые сопоставляются параметрам политики GPO "
 "(Deny)BatchLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "Имена служб PAM, которые сопоставляются параметрам политики GPO "
 "(Deny)ServiceLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "Имена служб PAM, которым всегда предоставляется доступ на основе GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "Имена служб PAM, которым всегда запрещается доступ на основе GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr "Право доступа по умолчанию (или разрешение/запрет) для имён служб PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "Конкретный сайт для использования клиентом"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Максимальный срок действия (в днях) пароля учётной записи компьютера, по "
 "достижении которого он должен быть обновлён"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Параметр для настройки задания по обновлению учётной записи компьютера"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 "Следует ли обновлять пароль учётной записи компьютера в базе данных Samba"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Использовать порт LDAPS для запросов LDAP и глобального каталога"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "Не отфильтровывать группы, локальные в домене, в других доменах"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Адрес сервера Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Адрес резервного сервера Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Область действия Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Тайм-аут проверки подлинности"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Следует ли создавать файлы kdcinfo"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Место для размещения фрагментов конфигурации krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Каталог для хранения кэша учётных данных"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Расположение кэша учётных данных пользователя"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Расположение keytab-файла для проверки учётных данных"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Включить проверку учётных данных"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "При отсутствии соединения сохранить пароль и пройти проверку подлинности "
 "позже"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Возобновляемое время жизни TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Время жизни TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Временной интервал между двумя проверками для обновления"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Включает FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Выбирает участника, которого следует использовать для FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "Использовать анонимный PKINIT для запроса учётных данных FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Включает преобразование участников в каноническую форму"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Включает участники-предприятия"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Включает использование областей поддоменов для проверки подлинности"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "Сопоставление имён пользователей с именами участников Kerberos"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "Сервер, на котором запущена служба смены пароля (если не на KDC)"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, URI сервера LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, URI сервера LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Base DN по умолчанию"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Тип схемы, используемой на LDAP-сервере, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Режим, который используется для смены пароля пользователя"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Bind DN по умолчанию"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Тип маркера проверки подлинности для bind DN по умолчанию"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Маркер проверки подлинности для bind DN по умолчанию"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Временной интервал для попытки соединения"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Временной интервал для попытки синхронизации операций LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 "Временной интервал между попытками возобновления соединения при нахождении в "
 "автономном режиме"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Использовать для имён областей только верхний регистр"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Файл, который содержит сертификаты CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Путь к каталогу с сертификатами CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Файл, который содержит сертификат клиента"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Файл, который содержит ключ клиента"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Список возможных средств шифрования"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Требуется проверка сертификата TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Укажите механизм SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Укажите ID авторизации SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Укажите область авторизации SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 "Укажите минимальное значение SSF для авторизации на LDAP с помощью SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 "Укажите максимальное значение SSF для авторизации на LDAP с помощью SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Keytab-файл службы Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Использовать проверку подлинности Kerberos для LDAP-соединений"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Переходить по ссылкам LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Время жизни TGT для LDAP-соединений"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Как разыменовывать псевдонимы"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Имя службы для поиска с помощью службы DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Количество записей для получения в ответ на один запрос LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "Количество участников, которых должно не хватать, для активации полного "
 "разыменования"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Игнорировать нечитаемые ссылки LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1413,7 +1409,7 @@ msgstr ""
 "Следует ли библиотеке LDAP выполнять обратный просмотр для преобразования "
 "имени узла в каноническую форму во время привязки SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1421,30 +1417,36 @@ msgstr ""
 "Разрешает сохранять локальных пользователей как участников группы LDAP для "
 "серверов, которые используют схему RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "Атрибут entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "Атрибут lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "Как долго поддерживать подключение к серверу LDAP перед отключением"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Отключить управление переходами между страницами LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Отключить получение диапазонов Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "Использовать расширение ppolicy"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Временной интервал для ожидания поискового запроса"
@@ -2053,34 +2055,34 @@ msgstr "Путь к исходному тексту файла passwd."
 msgid "Path of group file sources."
 msgstr "Путь к исходному тексту файла group."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr "Не удалось выполнить операцию конфигурации\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr "'"
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 "Неподдерживаемое значение '%s' параметра конфигурации '%s'! Только 'root' "
 "или '"
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Запускаться в качестве службы (по умолчанию)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Запускаться интерактивно (не службой)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Вывести номер версии и выйти"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -2091,99 +2093,99 @@ msgstr ""
 "Недопустимый параметр %s: %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "Параметр -i|--interactive нельзя использовать вместе с -D|--daemon\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr "Не удалось получить исходные возможности\n"
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 "Поддержка пользователей службы без полномочий root не реализована. "
 "Невозможно запустить ниже %"
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr "Не возможно прочитать конфигурацию: '%s'\n"
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr "Не удалось ускорить процесс «мониторинга» SSSD: %s"
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Недостаточно памяти\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Разрешить дампы памяти"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Дескриптор открытых файлов для журнала отладки"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "Пользователь, от имени которого следует создать ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Группа, от имени которой следует создать ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "Использовать анонимный PKINIT для запроса билета защиты FAST"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Область действия Kerberos"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Запрашиваемое время жизни билета"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Запрашиваемое возобновляемое время жизни билета"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "Параметры FAST («never», «try», «demand»)"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "Указывает участник-сервер, который следует использовать для FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Запрашивает преобразование имени участника в каноническую форму"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Использовать нестандартную версию krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "Идентификатор цепочки Tevent, используемый для ведения журнала"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "Проверить PAC флаги"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "Ошибка talloc_asprintf.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "Ошибка set_debug_file_from_fd.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Домен поставщика информации (обязательный)"
 
@@ -2215,16 +2217,16 @@ msgstr "Произошла ошибка, но не удалось найти е
 msgid "Unexpected error while looking for an error description"
 msgstr "Непредвиденная ошибка при поиске описания ошибки"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Доступ запрещён. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Сообщение сервера: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
@@ -2232,50 +2234,50 @@ msgstr ""
 "После входа в систему не будет предоставлен TGT Kerberos. Это может помешать "
 "нормальной работе пользователя."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "Введите PIN:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Пароли не совпадают"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Поддержка сброса пароля пользователем root не предусмотрена."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Проверка подлинности с учётными данными из кэша"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", срок действия вашего кэшированного пароля истечёт: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Срок действия пароля истёк. Осталось попыток входа в систему: %1$d."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Срок действия пароля истекает через %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Срок действия пароля истёк."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Проверка подлинности запрещена до: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Система находится в автономном режиме, невозможно сменить пароль"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2283,11 +2285,11 @@ msgstr ""
 "После смены одноразового пароля необходимо выйти из системы и снова войти в "
 "неё, чтобы получить билет"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN заблокирован"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2295,67 +2297,67 @@ msgstr ""
 "TGT Kerberos не предоставлен, поскольку на сервере не предусмотрена "
 "поддержка этого метода. Это повлияет на работу системы единого входа (SSO)."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Не удалось сменить пароль. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "Пожалуйста, авторизуйтесь на %1$s и нажмите ENTER."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 "Пожалуйста, авторизуйтесь с помощью PIN-кода %1$s на %2$s и нажмите ENTER."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "Пожалуйста, вставьте (повторно/другую) смарт-карту"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Новый пароль: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Введите новый пароль ещё раз: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Первый фактор: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Второй фактор (необязательно): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Второй фактор: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "Вставьте устройство с ключом доступа и нажмите ENTER."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Пароль: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Первый фактор (текущий пароль): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Текущий пароль: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Срок действия пароля истёк. Необходимо сейчас изменить ваш пароль."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Уровень отладки для запуска"
 
@@ -2364,7 +2366,7 @@ msgstr "Уровень отладки для запуска"
 msgid "The SSSD domain to use"
 msgstr "Домен SSSD"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Ошибка при установке локали\n"
 
@@ -2434,85 +2436,89 @@ msgstr "sss_ssh_knownhostsproxy: подключение к узлу %s, порт
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: не удалось разрешить имя узла %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Указанным параметрам поиска не соответствует ни один объект в кэше\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "Не удалось объявить недействительность %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "Не удалось объявить недействительность %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Объявить недействительными все кэшированные записи"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Объявить недействительным конкретного пользователя"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Объявить недействительными всех пользователей"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Объявить недействительной конкретную группу"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Объявить недействительными все группы"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Объявить недействительной конкретную сетевую группу"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Объявить недействительными все сетевые группы"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Объявить недействительной конкретную службу"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Объявить недействительными все службы"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Объявить недействительной конкретную карту autofs"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Объявить недействительными все карты autofs"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Объявить недействительным конкретный узел SSH"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Объявить недействительными все узлы SSH"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Объявить недействительным конкретное правило sudo"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Объявить недействительными все кэшированные правила sudo"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Объявить недействительными только записи из конкретного домена"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2521,11 +2527,11 @@ msgstr ""
 "недействительность одного объекта, принимают только один предоставленный "
 "аргумент.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Выберите хотя бы один объект для объявления недействительным\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2535,7 +2541,7 @@ msgstr ""
 "(доверенным доменом), используйте полностью определённое имя вместо "
 "параметра --domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Не удалось открыть доступные домены\n"
 
@@ -2569,161 +2575,161 @@ msgstr "Не удалось прочитать входные данные по
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Некорректные входные данные, укажите либо «%s», либо «%s».\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Ошибка при выполнении внешней команды\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Ошибка при попытке выполнения внешней команды '%s'\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "Не удалось выполнить команду '%s', код [%d]\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "Необходимо запустить SSSD. Сделать это сейчас?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "Необходимо завершить работу SSSD. Сделать это сейчас?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "Необходимо перезапустить SSSD. Сделать это сейчас?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "Состояние SSSD:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Список доступных доменов"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Показать информацию о домене"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "Показать информацию о пользователе и проверить аутентификацию"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Создать отчет о доступе к домену"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Сведения о кэшированных данных:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Сведения о кэшированном пользователе"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Сведения о кэшированной группе"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Сведения о кэшированной сетевой группе"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Инструменты для работы с локальными данными:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Создать резервную копию локальных данных"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Восстановить локальные данные из резервной копии"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "Создать резервную копию локальных данных и удалить кэшированные данные"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Аннулировать все кэшированные объекты"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Управление индексами кэша"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Инструменты файлов журнала:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Удалить существующие файлы журнала SSSD"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "Архивировать файлы журналов SSSD в архив tar"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "Изменить или вывести информацию об уровне отладки SSSD"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Анализ записанных в журнал данных"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Инструменты файлов конфигурации:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "Выполнить статический анализ конфигурации SSSD"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Инструменты, связанные с сертификатом:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Показать информацию о сертификате"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Показать пользователей, сопоставленных с сертификатом"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Проверить соответствие и правило сопоставления с помощью сертификата"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr "Инструменты, связанные с объектами групповой политики:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr "Сведения о кэшированном объекте групповой политики"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr "Перечислить кэшированные объекты групповой политики"
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr "Удалить кэшированный объект групповой политики"
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr "Удалить все кэшированные объекты групповой политики"
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Инструменты, связанные с ключом:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "Зарегистрировать ключ доступа"
 
@@ -2777,7 +2783,7 @@ msgstr "Версия политики"
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Ошибка: не удалось получить объект [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: не удалось прочитать значение [%d]: %s\n"
@@ -2791,101 +2797,101 @@ msgstr "Укажите имя."
 msgid "Unable to parse name %s.\n"
 msgstr "Не удалось разобрать имя %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Поиск по SID"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Поиск по ID пользователя"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Время истечения срока действия групп инициализации"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Поиск по ID группы"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr "Поиск по guid объекта групповой политики"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Не удалось разобрать аргументы команды: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr "%s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Не удалось вывести объект: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr "ошибка talloc\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr "Невозможно получить список атрибутов!\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr "Не удалось создать фильтр\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr "%s [%s]:\n"
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr "Не удалось получить базовый DN объекта групповой политики\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Не удалось выполнить поиск в sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "Не удалось преобразовать сообщение в атрибуты sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr "\t%s: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr "Не удалось найти атрибут GUID в записи объекта групповой политики\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 "Не удалось найти атрибут описания (description) в записи объекта групповой "
 "политики\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr "Не удалось удалить запись объекта групповой политики из кэша\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
@@ -2894,116 +2900,116 @@ msgstr ""
 "Путь к объекту групповой политики еще не был сохранен в кеше. Пожалуйста, "
 "удалите файлы вручную из [%s]\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr "Не удалось определить реальный путь для [%s]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 "Путь к кэшированному объекту групповой политики [%s] не находится в каталоге "
 "[%s], игнорируется.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Не удалось удалить загруженные файлы объекта групповой политики: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Не удалось получить запись кэша: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr "Не удалось определить домен объекта\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr "Не удалось найти атрибут GUID в записи объекта групповой политики.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Не удалось удалить объект групповой политики: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr "%s удален из кеша\n"
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Показать отладочную информацию"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "Укажите сертификат в кодировке base64."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "Не удалось подключиться к системной шине!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - сопоставленные пользователи не найдены -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "Правило сопоставления"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Правило соответствия"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Не удалось разобрать аргументы команды\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Недостаточно памяти!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Не удалось настроить контекст привязки сертификатов.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "Не удалось добавить правила сопоставления и соответствия из-за ошибки [%d]"
 "[%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Не удалось декодировать строку base64.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Сертификат соответствует правилу.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Сертификат не соответствует правилу.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "Ошибка при попытке установить соответствие сертификата [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "Не удалось создать фильтр сопоставления [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -3016,7 +3022,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -3027,35 +3033,35 @@ msgstr ""
 "находится по пути «/my/path/sssd.conf», расположением каталога фрагментов "
 "будет «/my/path/conf.d».)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "Файл %1$s не существует.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "Нет никакой конфигурации.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Не удалось прочитать «%s»: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Не удалось запустить средства проверки"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Проблемы, выявленные средствами проверки: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Сообщения, созданные при объединении конфигурации: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Использованных файлов фрагментов конфигурации: %zu\n"
@@ -3077,102 +3083,102 @@ msgstr "Не удалось экспортировать переопредел
 msgid "Unable to export group overrides\n"
 msgstr "Не удалось экспортировать переопределения групп\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Переопределить существующую резервную копию"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Не удалось импортировать переопределения пользователей\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Не удалось импортировать переопределения групп\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Запустить SSSD, если запуск не был выполнен"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Перезапустить SSSD после импорта данных"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Создать пустые файлы кэша и импортировать локальные данные"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Остановить SSSD перед удалением кэша"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Запустить SSSD после удаления кэша"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Создание резервной копии локальных данных...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "Не удалось создать резервную копию локальных данных, невозможно удалить "
 "кэш.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Удаление файлов кэша...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Не удалось удалить файлы кэша\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Восстановление локальных данных...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "Создание индекса кэша для домена %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "Удаление индекса кэша для домена %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "Индексы для домена %1$s:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Атрибут: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Направить на определенный домен"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "домен"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Атрибут для индекса"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "атрибут"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "Действие не предусмотрено\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3181,180 +3187,180 @@ msgstr ""
 "Неизвестное действие: %1$s\n"
 "Допустимые действия «%2$s», «%3$s» и «%4$s»\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Атрибут (-ы) не задан\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "Атрибут %1$s не проиндексирован.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "Атрибут %1$s уже проиндексирован.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Ошибка операции с индексом: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "Не забудьте также обновить индексы на удаленных поставщиках данных.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr "Показать список доменов, включая основные и доверенные"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "В сети"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Не в сети"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Состояние подключения: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "В этом домене нет активных серверов.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Активные серверы:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "нет подключения"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Серверы не обнаружены.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "Обнаружены серверы %s:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "На данный момент отсутствуют.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Показать состояние подключения"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Показать информацию об активном сервере"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Показать список обнаруженных серверов"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Укажите имя домена."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Не удалось получить состояние подключения\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Не удалось получить список серверов\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD не запущен.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Неизвестный домен\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Недоступная служба\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Удалить файлы журнала вместо усечения"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Удаление файлов журнала...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Не удалось удалить файлы журнала\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Усечение файлов журнала...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Не удалось усечь файлы журнала\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Архивация файлов журнала в %s...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Не удалось архивировать файлы журнала\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "Направить на службу SSSD"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "Направить на службу NSS"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "Направить на службу PAM"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "Направить на службу SUDO"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "Направить на службу AUTOFS"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "Направить на службу SSH"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "Направить на службу PAC"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "Направить на службу IFP"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Укажите уровень отладки, который следует установить"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "ОШИБКА: Отсутствует поддержка идентификатора цепочки Tevent, анализатор "
@@ -3421,19 +3427,19 @@ msgstr ""
 " - оболочка: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "Действие PAM [auth|acct|setc|chau|open|clos], по умолчанию: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "Служба PAM, по умолчанию: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Укажите имя пользователя."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3446,22 +3452,22 @@ msgstr ""
 "служба: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "Не удалось найти имя пользователя с помощью [%s].\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "Не удалось найти пользователя InfoPipe с помощью [%s].\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "Ошибка pam_start: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3469,12 +3475,12 @@ msgstr ""
 "проверка pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "Ошибка pam_get_item: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3483,7 +3489,7 @@ msgstr ""
 "pam_authenticate для пользователя [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3491,7 +3497,7 @@ msgstr ""
 "проверка pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3500,7 +3506,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3508,7 +3514,7 @@ msgstr ""
 "проверка pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3517,7 +3523,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3525,7 +3531,7 @@ msgstr ""
 "проверка pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3534,7 +3540,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3542,7 +3548,7 @@ msgstr ""
 "проверка pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3551,7 +3557,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3559,7 +3565,7 @@ msgstr ""
 "проверка pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3568,26 +3574,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "неизвестное действие\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "Среда PAM:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - нет среды -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Указать нестандартный файл конфигурации"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Сообщает о том, что ответчик активирован с помощью сокета"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Количество попыток подключения к поставщикам данных"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Отключить интерфейс netlink"
 
diff --git a/po/sssd.pot b/po/sssd.pot
index c14a6a3165c..3a3fa2ad64b 100644
--- a/po/sssd.pot
+++ b/po/sssd.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -43,26 +43,22 @@ msgid "Command to start service"
 msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -70,63 +66,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -134,1131 +130,1137 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1842,32 +1844,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1875,97 +1877,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -1997,140 +1999,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2139,7 +2141,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2201,102 +2203,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2330,161 +2336,161 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2538,7 +2544,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2552,211 +2558,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2765,42 +2771,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2822,280 +2828,280 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3158,19 +3164,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3179,120 +3185,120 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
diff --git a/po/sv.po b/po/sv.po
index 04d70495ef8..cca3c98d4bb 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-08-29 20:38+0000\n"
 "Last-Translator: Göran Uddeborg <goeran@uddeborg.se>\n"
 "Language-Team: Swedish <https://translate.fedoraproject.org/projects/sssd/"
@@ -52,26 +52,22 @@ msgid "Command to start service"
 msgstr "Kommando för att starta tjänst"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Antal gånger att försöka ansluta till dataleverantörer"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "Antalet fildeskriptorer som får öppnas av denna svarare"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "Inaktiv tid före en klient automatiskt kopplas ifrån"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Inaktiv tid före den svarande automatiskt stängs av"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "Fråga alltid alla cacharna före dataleverantörerna frågas"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -83,23 +79,23 @@ msgstr ""
 "Detta värde är i sekunder och beräknas enligt följande: offline_timeout + "
 "random_offset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD-tjänster att starta"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD-domäner att starta"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Reguljäruttryck för att tolka användarnamn och domän"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Printf-kompatibla format för att visa fullständigt kvalificerade namn"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -107,38 +103,38 @@ msgstr ""
 "Katalog i filsystemet där SSSD skall spara Kerberos-cachefiler för "
 "återuppspelning."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Domän att lägga till till namn utan en domändel."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Användaren att släppa behörigheter till"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Trimma certifikatverifikation"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Alla mellanrum i grupp- eller användarnamn kommer att ersättas med detta "
 "tecken"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 "Trimma sssd till att beakta eller ignorera ändringar av netlink-tillståndet"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Aktivera eller avaktivera den implicita fildomänen"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "En specifik ordning på domänerna som skall slås upp"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -146,7 +142,7 @@ msgstr ""
 "Styr om SSSD skall övervaka tillståndet för resolv.conf för att identifiera "
 "när den behöver uppdatera sin interna DNS-uppslagare."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -158,75 +154,75 @@ msgstr ""
 "försöka använda inotify till detta, och kommer falla tillbaka på att polla "
 "resolv.conf var femte sekund om inotify inte kan användas."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "Kör PAC-svararen automatiskt för AD- och IPA-leverantörer"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "Aktivera eller avaktivera kärndumpar för alla SSSD-processer."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Trimma lösennyckelns verifikationsbeteende"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Tidsgränslängd för uppräkningscache (sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Tidsgränslängd för bakgrundsuppdateringar av postcache (sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Tidsgränslängd för negativ cache (sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Tidsgränslängd för negativ filcache (sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Användare som SSSD uttryckligen skall bortse ifrån"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Grupper som SSSD uttryckligen skall bortse ifrån"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Skall filtrerade användare förekomma i grupper"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Värdet på lösenordsfältet som NSS-leverantörer skall returnera"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr "Åsidosätt hemkatalogvärdet från identitetsleverantören med detta värde"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Ersätt ett tomt hemkatalogvärde från identitetsleverantören med detta värde"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "Åsidosätt skalvärdet från identitetsleverantören med detta värde"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Listan på skal användare får lov att logga in med"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "Listan på skal som kommer förbjudas, och ersättas med standardskalet"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -234,15 +230,15 @@ msgstr ""
 "Om ett skal lagrat i en central katalog är tillåtet men inte tillgängligt, "
 "använd detta alternativ"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Skal att använda om leverantören inte listar något"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Hur länge sparade poster i minnet är giltiga"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -250,7 +246,7 @@ msgstr ""
 "Storlek (i megabyte) av datatabellen som allokerats inuti den snabba i-"
 "minnet-cachen för lösenordsbegäranden"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -258,7 +254,7 @@ msgstr ""
 "Storlek (i megabyte) av datatabellen som allokerats inuti den snabba i-"
 "minnet-cachen för gruppbegäranden"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -266,7 +262,7 @@ msgstr ""
 "Storlek (i megabyte) av datatabellen som allokerats inuti den snabba i-"
 "minnet-cachen för init-gruppbegäranden"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -274,7 +270,7 @@ msgstr ""
 "Värdet på denna flagga kommer användas i expansionen av flaggan "
 "override_homedir om mallen innehåller formatsträngen %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -282,7 +278,7 @@ msgstr ""
 "Anger tiden i sekunder under vilken listan av underdomäner kommer betraktas "
 "som giltiga."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -292,16 +288,16 @@ msgstr ""
 "bakgrunden om de begärs utöver en procentsats av värdet entry_cache_timeout "
 "för domänen."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Hur länge sparade inloggningar tillåts mellan online-inloggningar (dagar)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Hur många misslyckade inloggningsförsök som tillåts i frånkopplat läge"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -309,85 +305,85 @@ msgstr ""
 "Hur länge (minuter) som inloggning nekas efter att "
 "frånkopplade_inloggningsförsök har nåtts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "Vilka slags meddelanden som visas för användaren under autentisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Filtrera PAM-svar skickade till pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr "Hur många sekunder identitetsinformationen hålls sparad för PAM-frågor"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "Hur många dagar före ett lösenord går ut en varning skall visas"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Lista över betrodda uid:n eller användarnamn"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "Lista över domäner tillgängliga även för ej betrodda användare."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "Meddelande som skrivs när ett användarkonto har gått ut."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "Meddelande som skrivs när ett användarkonto är låst."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Tillåt certifikatbaserad/smartkortsautentisering."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "Sökväg till certifikatdatabasen med PKCS#11-moduler."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Trimma certifikatverifikation för PAM-autentisering."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "Hur många sekunder kommer pam_sss vänta på p11_child att avsluta"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr "Vilka PAM-tjänster tillåts att kontakta applikationsdomäner"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Tillåtna tjänster för användning av smartkort"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Ytterligare tidsgräns att vänta på ett kort om begärt"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "PKCS#11 URI för att begränsa urvalet av enheter för smartkortsautentisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "När skall PAM-respondenten framtvinba en initgruppbegäran"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "Lista av PAM-tjänster som tillåts autentisera med GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "Huruvida autentiserad UPN skall matchas med målanvändaren"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -395,28 +391,28 @@ msgstr ""
 "Lista av par <PAM-tjänst>:<autentiseringsindikator> som måste upprätthållas "
 "för PAM-åtkomst med GSSAPI-autentisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Tillåt autentisering med lösennyckelsenhet."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "Hur många sekunder kommer pam_sss vänta på passkey_child att avsluta"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Aktivera felsökning i biblioteket libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "Om tidsbaserade attribut i sudo-regler skall beräknas"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 "Om sant kommer SSSD byta tillbaka till ordningslogiken att lägre vinner"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -424,12 +420,12 @@ msgstr ""
 "Maximalt antal regler som kan som kan uppdateras samtidigt. Om detta "
 "överskrids utförs en fullständig uppdatering."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "Om värdnamn och adresser i known_hosts-filen skall göras till kontrollsummor"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -437,15 +433,15 @@ msgstr ""
 "Hur många sekunder att behålla en värd i filen known_hosts efter att dess "
 "värdnycklar begärdes"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Sökväg till lagring av betrodda CA-certifikat"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Tillåt att generera ssh-nycklar från certifikat"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -453,23 +449,23 @@ msgstr ""
 "Använd följande matchningsregler för att filtrera certifikatet för ssh-"
 "nyckelgenerering"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr "Lista över UID:er eller användarnamn som tillåts komma åt PAC-svararen"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Hur länge PAC-data betraktas som giltiga"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Validera PAC:en"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Lista över användarattribut InfoPipe får publicera"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -479,7 +475,7 @@ msgstr ""
 "Inga användare spelas in. some – Användare/grupper uppräknade i användar- "
 "och gruppalternativen spelas in. all – Alla användare spelas in."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -489,7 +485,7 @@ msgstr ""
 "sessioner aktiverat. Matchar användarnamn som de returneras av NSS. D.v.s. "
 "efter eventuellt utbyte av mellanslag, ändring av skiftläge, etc."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -499,7 +495,7 @@ msgstr ""
 "sessioner aktiverat. Matchar gruppnamn som de returneras av NSS. D.v.s. "
 "efter eventuellt utbyte av mellanslag, ändring av skiftläge, etc."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -507,7 +503,7 @@ msgstr ""
 "En kommaseparerad lista av användare att undanta från inspelning, endast när "
 "scope=all"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -515,101 +511,101 @@ msgstr ""
 "En kommaseparerad lista av grupper vars medlemmar skall undantas från "
 "inspelning, endast när scope=all "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Identitetsleverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Autentiseringsleverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Leverantör av åtkomstkontroll"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Leverantör av lösenordsändringar"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO-leverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs-leverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Värdidentitetsleverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "SELinux-leverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Sessionshanteringsleverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Uppslagsleverantör"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "Huruvida domänen är användbar av OS:et eller av program"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Aktivera eller avaktivera domänen"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Minsta användar-ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Största användar-ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Aktivera uppräkning av alla användare/grupper"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Cache-kreditiv för frånkopplad inloggning"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Visa användare/grupper i fullständigt kvalificerat format"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Inkludera inte gruppmedlemmar i gruppuppslagningar"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Tidsgränslängd för postcache (sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr "Begränsa eller föredra en specifik adressfamilj vid DNS-uppslagningar"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Hur länge cachade poster skall behållas efter senaste lyckade inloggning "
 "(dagar)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -617,21 +613,21 @@ msgstr ""
 "Hur länge SSSD skall prata med en enskild DNS-server innan den försöker med "
 "nästa server (millisekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 "Hur länge SSSD skall fortsätta försöka slå upp en enskild DNS-fråga "
 "(sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr "Hur länge man väntar på svar från DNS när servrar slås upp (sekunder)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Domändelen av DNS-frågan för tjänstedetektering"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -640,102 +636,102 @@ msgstr ""
 "Anger intervallet, i sekunder, som SSSD väntar före den försöker återansluta "
 "till primärservern efter en lyckad anslutning till reservservern"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Åsidosätt GID-värdet från identitetsleverantören med detta värde"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Behandla användarnamn som skiftlägeskänsliga"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Hur ofta utgångna poster skall förnyas i bakgrunden"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 "Maximal intervallavvikelse vid uppdatering av utgångna poster i bakgrunden"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Huruvida klienternas DNS-poster uppdateras automatiskt"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "TTL:en att använda för klientens DNS-post efter att ha uppdaterat den"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "Gränssnittet vars IP skall användas för dynamiska DNS-uppdateringar"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Hur ofta klienternas DNS-poster periodiskt skall uppdateras"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "Maximal intervallavvikelse vid uppdatering av klientens DNS-post"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "Huruvida leverantören explicit skall uppdatera PTR-posten också"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Huruvida verktyget nsupdate skall använda TCP som standard"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Vilken sorts autentisering som skall användas för att utföra DNS-"
 "uppdateringen"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "Åsidosätt DNS-servern som används för att utföra DNS-uppdateringen"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Styr uppräkning av betrodda domäner"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Hur ofta skall listan över underdomäner uppdateras"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "Maximal intervallavvikelse fid uppdatering av subdomänlistan"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Lista över flaggor som skall ärvas in i en underdomän"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Standard hemkatalogvärde för underdomäner"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr "Hur länge cachade kreditiv får användas för cachad autentisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "Huruvida privata grupper för användare skall skapas automatiskt"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Visa en varning N dagar före lösenordet går ut."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Diverse taggar lagrade av realmd-konfigurationstjänsten för denna domän."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -743,7 +739,7 @@ msgstr ""
 "Leverantören som skall hantera hämtandet av underdomäner. Detta värde skall "
 "alltid vara samma som id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -751,7 +747,7 @@ msgstr ""
 "Hur många sekunder en värds ssh-nyckel behålls efter en uppdatering. D.v.s. "
 "hur länge värdnyckeln skall cachas."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -761,100 +757,100 @@ msgstr ""
 "värde den minsta längden den första autentiseringsfaktorn (långvarigt "
 "lösenord) måste ha för att sparas som en SHA512-kontrollsumma i cachen."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Lokal policy för autentiseringsmetoder "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA-domän"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA-serveradress"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Adress till reserv-IPA-server"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA-klientvärdnamn"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "Om klientens DNS-post i FreeIPA automatiskt skall uppdateras"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Sökbas för HBAC-relaterade objekt"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "Tidsåtgången mellan uppslagningar av HBAC-reglerna mot IPA-servern"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 "Tiden i sekunder mellan uppslagningar av SELinux-mappningar mot IPA-servern"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr "Om satt till falskt kommer värdargument givna av PAM ignoreras"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "Platsen för automatmonteraren denna IPA-klient använder"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "Sökbas för objekt som innehåller information om IPA-domänen"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "Sökbas för objekt som innehåller information om ID-intervall"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Aktivera DNS-sajter - platsbaserad detektering av tjänster"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Sökbas för vybehållare"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Objektklass för vybehållare"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Attribut med namnet på vyn"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Objektklass för åsidosättande objekt"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Attribut med referensen till originalobjektet"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Objektklass för användaråsidosättande objekt"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Objektklass för gruppåsidosättande objekt"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Sökväg för objekt relaterade till skrivbordsprofiler"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -862,7 +858,7 @@ msgstr ""
 "Tiden i sekunder mellan uppslagningar av skrivbordsprofilsregler mot IPA-"
 "servern"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -870,41 +866,41 @@ msgstr ""
 "Tiden i minuter mellan uppslagningar av skrivbordsprofilsregler mot IPA-"
 "servern när den senaste förfrågan inte hittade någon regel"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "Sökbas för SUBAID-intervall"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Vilka regler skall användas för att avgöra åtkomstkontroll"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "LDAP-attributet som innehåller värdens FQDN."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "Objektklassen hos en värdpost i LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "Använd den givna strängen som en sökbas för värdobjekt."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "LDAP-attributet som innehåller värdens publika SSH-nycklar."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "LDAP-attributet som innehåller NIS-domännamnet på nätgruppen."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "LDAP-attributet som innehåller namnen på nätgruppens medlemmar."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -912,7 +908,7 @@ msgstr ""
 "LDAP-attributet som räknar upp FQDN:er för värdar och värdgrupper som är "
 "medlemmar av nätgruppen."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -920,11 +916,11 @@ msgstr ""
 "LDAP-attributet som räknar upp värdar och värdgrupper som är direkta "
 "medlemmar av nätgruppen."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "LDAP-attributet som räknar upp nätgruppens medlemskap."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -932,20 +928,20 @@ msgstr ""
 "LDAP-attributet som räknar upp systemanvändare och grupper som är direkta "
 "medlemmar av nätgruppen."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "LDAP-attributet som motsvarar nätgruppnamnet."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "Objektklassen hos en nätgruppspost i LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "LDAP-attributet som innehåller UUID/GUID för ett LDAP-nätgruppobjekt."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -953,11 +949,11 @@ msgstr ""
 "LDAP-attributet som innehåller huruvida användaravbildningar är aktiverade "
 "för användning eller inte."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "LDAP-attributet som innehåller värtkategorin såsom ”all”."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -965,18 +961,18 @@ msgstr ""
 "LDAP-attributet som innehåller alla värdar / värdgrupper denna regel matchar "
 "mot."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "LDAP-attributet som innehåller alla användare / grupper denna regel matchar "
 "mot."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "LDAP-attributet som innehåller namnet på SELinux-användaravbildningen."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -984,19 +980,19 @@ msgstr ""
 "LDAP-attributet som innehåller DN för HBAC-regeln som kan användas för att "
 "matcha istället för memberUser och memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "LDAP-attributet som innehåller själva SELinux-användarsträngen."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "LDAP-attributet som innehåller användarkategorin såsom ”all”."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "LDAP-attributet som innehåller ett unikt ID för användaravbildningen."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1004,50 +1000,50 @@ msgstr ""
 "Flaggan anger att SSSD:n kör på en IPA-server och skall utföra uppslagningar "
 "av användare och grupper från betrodda domäner på ett annat sätt."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "Använd den givna strängen som en sökbas för betrodda domäner."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active Directory-domän"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Aktivera Active Directory-domäner"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Adress till Active Directory-server"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Adress till Active Directory-reservserver"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Active Directory-klientvärdnamn"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "LDAP-filter för att bestämma åtkomstprivilegier"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Huruvida den globala katalogen skall användas för uppslagningar"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Arbetsläge för GPO-baserad åtkomstkontroll"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "Tidsåtgången mellan uppslagningar av GPO-policyfiler mot AD-servern"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
@@ -1055,7 +1051,7 @@ msgstr ""
 "PAM-tjänstenamn som översätts till GPO-policyinställningen "
 "(Deny)InteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1063,287 +1059,287 @@ msgstr ""
 "PAM-tjänstenamn som översätts till GPO-policyinställningen "
 "(Deny)RemoteInteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "PAM-tjänstenamn som översätts till GPO-policyinställningen "
 "(Deny)NetworkLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "PAM-tjänstenamn som översätts till GPO-policyinställningen "
 "(Deny)BatchLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "PAM-tjänstenamn som översätts till GPO-policyinställningen "
 "(Deny)ServiceLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "PAM-tjänstenamn för vilka GPO-baserad åtkomst alltid tillåts"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "PAM-tjänstenamn för vilka GPO-baserad åtkomst alltid nekas"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Standardinloggningsrättigheter (eller permit/deny) att använda för omappade "
 "PAM-tjänstenamn"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "en viss sajt att användas av klienten"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr "Maximal ålder i dagar innan maskinkontots lösenord skall förnyas"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Flagga för att trimma maskinkontots förnyelseuppgift"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr "Huruvida lösenordet för maskinkontot i Sambadatabasen skall uppdateras"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Använd LDAPS-porten för LDAP och Global Catalog-begäranden"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "Filtrera inte domänlokala grupper från andra domäner"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Adress till Kerberosserver"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Adress till reservserver för Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberosrike"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Autentiseringstidsgräns"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Huruvida kdcinfo-filer skall skapas"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Var konfigurationssnuttar för krb5 skall läggas"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Katalog att lagra kreditiv-cachar i"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Plats för användarens kreditiv-cache"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Plats för nyckeltabellen för att validera kreditiv"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Aktivera validering av kreditiv"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "Lagra lösenord när ej ansluten för ansluten autentisering senare"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Förnybar livstid för TGT:n"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Livstid för TGT:n"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Tid mellan två kontroller av förnyelse"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Aktiverar FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Väljer huvudman att använda för FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "Använd anonym PKINIT för att begära FAST-kreditiv"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Aktivera kanonisk form av huvudman"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Aktiverar företagshuvudmän"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Aktiverar användningen av underdomänriken för autentisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "En översättning från användarnamn till Kerberos huvudmansnamn"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "Server där ändringstjänsten för lösenord kör om inte på KDC:n"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, URI:n för LDAP-servern"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, URI:n för LDAP-servern"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Standard bas-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Schematypen som används i LDAP-servern, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Läge som används för att ändra användares lösenord"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Standard bindnings-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Typen på autentiserings-token för standard bindnings-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Autentiserings-token för standard bindnings-DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Tidslängd att försöka ansluta"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Tidslängd att försöka synkrona LDAP-operationer"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Tidslängd mellan försök att återansluta vid frånkoppling"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Använd endast versaler för namn på riken"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Fil som innehåller CA-certifikat"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Sökväg till katalogen med CA-certifikat"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Fil som innehåller klientcertifikatet"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Fil som innehåller klientnyckeln"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Lista över möjliga chiffersviter"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Kräv TLS-certifikatverifiering"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Ange sasl-mekanismen att använda"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Ange sasl-auktorisering-id att använda"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Ange sasl-auktoriseringsrike att använda"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "Ange minsta SSF för LDAP-sasl-auktorisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "Ange största SSF för LDAP-sasl-auktorisering"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Kerberostjänstens nyckeltabell"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Använd Kerberosautentisering för LDAP-anslutningar"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Följer LDAP-hänvisningar"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Livslängd på TGT för LDAP-anslutning"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Hur alias skall derefereras"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Tjänstenamn för uppslagning av DNS-tjänster"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Antalet poster som skall hämtas i en enda LDAP-fråga"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "Antalet medlemmar som måste saknas för att orsaka en fullständig dereferering"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Ignorera oläsbara LDAP-referenser"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1351,7 +1347,7 @@ msgstr ""
 "Huruvida LDAP-biblioteket skall utföra en omvänd uppslagning för att ta fram "
 "värdnamnets kanoniska form under en SASL-bindning"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1359,31 +1355,37 @@ msgstr ""
 "Tillåter att behålla lokala användare som medlemmar i en LDAP-grupp för "
 "servrar som använder schemat RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN-attribut"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN-attribut"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "Hur länge en anslutning till LDAP-servern skall behållas före den kopplas ner"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Avaktivera flödesstyrningen (paging) av LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Avaktivera Active Directorys intervallhämtande"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "Använd utökningen ppolicy"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Tidslängd att vänta på en sökbegäran"
@@ -1982,33 +1984,33 @@ msgstr "Sökväg till lösenordsfilkällor."
 msgid "Path of group file sources."
 msgstr "Sökväg till gruppfilkällor."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr "Konfigurationsåtgärden misslyckades\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr "”"
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 "Ej stött värde ”%s” på konfigurationsalternativet ”%s”! Endast ”root” eller ”"
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Bli en demon (standard)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Kör interaktivt (inte en demon)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Skriv ut versionsnumret och avsluta"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -2019,99 +2021,99 @@ msgstr ""
 "Felaktig flagga %s: %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 "Flaggan -i|--interactive är inte tillåten tillsammans med -D|--daemon\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr "Misslyckades att hämta initiala förmågor\n"
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 "Stöd för icke-root-tjänsteanvändare är inte byggt. Kan inte köra under %"
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr "Kan inte läsa konfigurationen: ”%s”\n"
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr "Misslyckades att starta upp SSSD:s process ”monitor”: %s"
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Slut på minne\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Tillåt kärndumpar"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "En öppen fildeskriptor för felsökningsloggarna"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "Användaren att skapa en FAST-ccache som"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Gruppen att skapa en FAST-ccache som"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "Använd anonym PKINIT för att begära FAST-skyddad biljett"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Kerberosrike att använda"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Begärd livslängd på biljetten"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Begärd förnybar livslängd på biljetten"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "FAST-flaggor (”never”, ”try”, ”demand”)"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "Anger serverhuvudmannen att använda för FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Begär kanonisering av huvudmannanamnet"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Använd en anpassad version av krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "Tevent-kedje-ID använt för loggningssyfte"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "Kontrollera PAC-flaggor"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf misslyckades.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd misslyckades.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Domän för informationsleverantören (obligatoriskt)"
 
@@ -2143,16 +2145,16 @@ msgstr "Ett fel uppstod, men ingen beskrivning kan hittas."
 msgid "Unexpected error while looking for an error description"
 msgstr "Oväntat fel vid sökning efter ett felmeddelande"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Åtkomst nekas. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Servermeddelande: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
@@ -2160,50 +2162,50 @@ msgstr ""
 "Kerberos-TGT kommer inte att ges vid inloggning, användarupplevelsen kommer "
 "påverkas."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "Ange PIN:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Lösenorden stämmer inte överens"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Återställning av lösenord av root stöds inte."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Autentiserad med cachade kreditiv"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", ditt cache-lösenord kommer gå ut: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Ditt lösenord har gått ut. Du har en frist på %1$d inloggningar kvar."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Ditt lösenordet kommer gå ut om %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Ditt lösenordet har gått ut."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Autentisering nekas till: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Systemet är frånkopplat, ändring av lösenord är inte möjligt"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2211,11 +2213,11 @@ msgstr ""
 "Efter att ha ändrat OTP-lösenordet behöver du logga ut och tillbaka in för "
 "att få en biljett"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN-låst"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2223,66 +2225,66 @@ msgstr ""
 "Ingen Kerberos-TGT gavs eftersom servern inte stödjer denna metod. Din "
 "eninloggningsupplevelse (SSO) kommer påverkas."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Lösenordsändringen misslyckades. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "Autentisera vid %1$s och tryck på ENTER."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "Autentisera med PIN %1$s vid %2$s och tryck på ENTER."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "Sätt (igen) in ett (annat) smartkort"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Nytt lösenord: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Skriv det nya lösenordet igen: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Första faktorn: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Andra faktorn (frivillig): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Andra faktorn: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "Sätt in en lösennyckelsenhet, tryck sedan ENTER."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Lösenord: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Första faktorn (nuvarande lösenord): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Nuvarande lösenord: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Lösenordet har gått ut. Ändra ditt lösenord nu."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Felsökningsnivån att köra med"
 
@@ -2291,7 +2293,7 @@ msgstr "Felsökningsnivån att köra med"
 msgid "The SSSD domain to use"
 msgstr "SSSD-domäner att använda"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Fel när lokalen sattes\n"
 
@@ -2318,14 +2320,12 @@ msgid ""
 "\n"
 msgstr ""
 "\n"
-"*****************************************************************************"
-"*\n"
+"******************************************************************************\n"
 "Ditt system är konfigurerat att använda det föråldrade verktyget "
 "sss_ssh_knownhostsproxy.\n"
 "Läs manualsidan sss_ssh_knownhosts(1) för att få reda på mer om dess "
 "ersättning.\n"
-"*****************************************************************************"
-"*\n"
+"******************************************************************************\n"
 "\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
@@ -2363,85 +2363,89 @@ msgstr "sss_ssh_knownhostsproxy: anslutning till värden %s port %d: %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: Det gick inte att slå upp värdnamnet %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Inga cache-objekt matchade den angivna sökningen\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "Kunde inte invalidera %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "Kunde inte invalidera %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Invalidera alla cachade poster"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Invalidera en viss användare"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Invalidera alla användare"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Invalidera en viss grupp"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Invalidera alla grupper"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Invalidera en viss nätgrupp"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Invalidera alla nätgrupper"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Invalidera en viss tjänst"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Invalidera alla tjänster"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Invalidera en viss autofs-mapp"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Invalidera alla autofs-mappar"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Invalidera en viss SSH-värd"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Invalidera alla SSH-värdar"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Invalidera en viss sudo-regel"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Invalidera alla cachade sudo-regler"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Invalidera endast poster från en viss domän"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2449,11 +2453,11 @@ msgstr ""
 "Oväntat argument angivet, flaggor som invaliderar ett ensamt objekt tar bara "
 "ett ensamt angivet argument.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Välj åtminstone ett objekt att invalidera\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2462,7 +2466,7 @@ msgstr ""
 "Kunde inte öppna domänen %1$s. Om domänen är en underdomän (betrodd domän), "
 "använd fullt kvalificerat namn istället för parametrarna --domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Kunde inte öppna tillgängliga domäner\n"
 
@@ -2496,161 +2500,161 @@ msgstr "Kan inte läsa användarens indata\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Felaktig indata, ange antingen ”%s” eller ”%s”.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Fel när externt kommando kördes\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Fel när externt kommando kördes ”%s”\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "Kommandot ”%s” misslyckades med [%d].\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "SSSD behöver köras. Starta SSSD nu?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "SSSD får inte köra. Stoppa SSSD nu?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "SSSD behöver startas om. Starta om SSSD nu?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "SSSD status:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Lista tillgängliga domäner"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Skriv ut information om domänen"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "Skriv ut information om en användare och kontrollera autentiseringen"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Generera en åtkomstrapport för en domän"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Information om cachat innehåll:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Information om cachad användare"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Information om cachad grupp"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Information om cachad nätgrupp"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Lokala dataverktyg:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Säkerhetskopiera lokala data"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Återställ lokala data från en säkerhetskopia"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "Säkerhetskopiera lokala data och ta bort cachat innehåll"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Invalidera cachade objekt"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Hantera cachade index"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Loggfilsverktyg:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Ta bort befintliga SSSD-loggfiler"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "Arkivera SSSD-loggfiler in i en tarboll"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "Ändra eller skriv information om SSSD-felsökningsnivå"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Analysera loggade data"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Konfigurationsfilsverktyg:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "Utför statisk analys av SSSD-konfigurationen"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Certifikatrelaterade verktyg:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Skriv information om certifikatet"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Visa användare avbildade till certifikatet"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Kontrollera avbildnings- och matchningsregel för ett certifikat"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr "GPO-relaterade verktyg:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr "Information om cachad GPO"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr "Räkna upp cachade GPO:er"
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr "Ta bort cachad GPO"
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr "Ta bort alla cachade GPO:er"
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Lösennyckelrelaterade verktyg:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "Utför lösennyckelsregistrering"
 
@@ -2704,7 +2708,7 @@ msgstr "Policyversion"
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Fel: kan inte hämta objektet [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: Kan inte läsa värdet [%d]: %s\n"
@@ -2718,99 +2722,99 @@ msgstr "Ange namn."
 msgid "Unable to parse name %s.\n"
 msgstr "Kan inte tolka namnet %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Sök via SID"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Sök via användar-ID"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Init-gruppers utgångstid"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Sök via grupp-ID"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr "Sök via GPO-guid"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Misslyckades att tolka kommandoraden: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr "%s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Misslyckades med att skriva objekt: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr "talloc misslyckades\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr "Kan inte ta reda på attributlistan\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr "Kan inte skapa filter\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr "%s [%s]:\n"
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr "Kan inte ta reda på GPO:ns bas-DN\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Kan inte söka i sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "Kan inte konvertera meddelandet till sysdb-attribut: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr "\t%s: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr "Kunde inte hitta GUID-attribut i GPO-posten\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr "Kunde inte hitta beskrivningsattributet i GPO-posten\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr "Kunde inte radera GPO-posten från cachen\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
@@ -2818,114 +2822,114 @@ msgid ""
 msgstr ""
 "GPO-sökvägen lagrades inte ännu i cachen. Ta bort filer manuellt från [%s]\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr "Kunde inte avgöra verklig sökväg för [%s]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr "Den cachade GPO-sökvägen [%s] är inte under [%s], ignorerar.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Kan inte ta bort hämtade GPO-filer: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Misslyckades med att hämta cacheposten: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr "Kunde inte avgöra objektdomänen\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr "Kunde inte hitta GUID-attribut i GPO-posten\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Misslyckades med att radera GPO: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr "%s borttagen från cachen\n"
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Visa felsökingsinformation"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "Ange bas64-kodat certifikat."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "Det går inte att ansluta till systembussen!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " – inga avbildade användare hittade –"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "Avbildningsregel"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Matchningsregel"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Kan inte tolka kommandoargument\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Slut på minne!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Misslyckades att sätta upp certmap-kontext.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "Misslyckades att lägga till avbildnings- och matchningsregler med felet [%d]"
 "[%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Misslyckades att avkoda en base64-sträng.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Certifikatet matchar regeln\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Certifikatet matchar inte regeln.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "Fel vid certifikatsmatchning [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "Misslyckades att generera avbildningsfilter [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2938,7 +2942,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2949,35 +2953,35 @@ msgstr ""
 "satt till ”/min/sökväg/sssd.conf” används snuttkatalogen ”/min/sökväg/conf."
 "d”)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "Filen %1$s finns inte.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "Det finns ingen konfiguration.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Misslyckades med att läsa ”%s”: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Misslyckades att köra validerare"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Problem identifierade av validerare: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Meddelanden genererade under sammanslagning av konfigurationen: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Använd konfigurationssnuttfiler: %zu\n"
@@ -2999,101 +3003,101 @@ msgstr "Kan inte exportera användaråsidosättanden\n"
 msgid "Unable to export group overrides\n"
 msgstr "Kan inte exportera gruppåsidosättanden\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Åsidosätt befintlig säkerhetskopia"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Kan inte importera användaråsidosättanden\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Kan inte importera gruppåsidosättanden\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Starta SSSD om den inte kör"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Starta om SSSD efter import av data"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Skapa rena cachefiler och importera lokala data"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Stoppa SSSD före cachen tas bort"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Starta SSSD när cachen är borttagen"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Skapa säkerhetskopia av lokala data …\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "Kan inte skapa säkerhetskopia av lokala data, kan inte ta bort cachen.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Tar bort cache-filer …\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Kan inte ta bort cache-filer\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Återställer lokala data …\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "Skapar cache-index för domänen %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "Raderar cache-index för domänen %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "Index för domänen %1$s:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Attribut: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Sikta på en specifik domän"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "domän"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Attribut till index"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "attribut"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "Åtgärden angavs inte\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3102,180 +3106,180 @@ msgstr ""
 "Okänd åtgärd: %1$s\n"
 "Giltiga åtgärder är ”%2$s”, ”%3$s” och ”%4$s”\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Attribut (-a) angavs inte\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "Attribut %1$s inte indexerat.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "Attribut %1$s är redan indexerat.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Indexåtgärden misslyckades: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "Glöm inte att även uppdatera indexen på fjärrleverantörerna.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr "Visa domänlistan inklusive primär eller betrodd domäntyp"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "Uppkopplad"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Frånkopplad"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Uppkopplingsstatus: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "Denna domän har inga aktiva servrar.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Aktiva servrar:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "inte ansluten"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Inga servrar upptäcktes.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "Upptäckte %s servrar:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Ingen än så länge.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Visa uppkopplingsstatus"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Visa information om aktiv server"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Visa lista över upptäckta servrar"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Ange domännamn."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Kan inte ta reda på uppkopplingsstatus\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Kan inte ta reda på serverlistan\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD kör inte.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Okänd domän\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Onåbar tjänst\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Radera loggfiler istället för att hugga av"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Raderar loggfiler …\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Kan inte ta bort loggfiler\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Hugger av loggfiler …\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Kan inte hugga av loggfiler\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Arkiverar loggfiler in i %s …\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Kan inte arkivera loggfiler\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "Sikta på SSSD-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "Sikta på NSS-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "Sikta på PAM-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "Sikta på SUDO-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "Sikta på AUTOFS-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "Sikta på SSH-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "Sikta på PAC-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "Sikta på IFP-tjänsten"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Ange felsökningsnivå du vill sätta"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr "FEL: stöd för tevent-kedje-ID saknas, logganalysatorn stödjs inte.\n"
 
@@ -3340,19 +3344,19 @@ msgstr ""
 " - skal: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "PAM-åtgärd [auth|acct|setc|chau|open|clos], standard: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "PAM-tjänst, standard: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Ange användarnamn."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3365,22 +3369,22 @@ msgstr ""
 "tjänst: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "Användarnamnsuppslagning med [%s] misslyckades.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "InfoPipe-användaruppslagning med [%s] misslyckades.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start misslyckades: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3388,12 +3392,12 @@ msgstr ""
 "testar pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item misslyckades: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3402,7 +3406,7 @@ msgstr ""
 "pam_authenticate för användaren [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3410,7 +3414,7 @@ msgstr ""
 "testar pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3419,7 +3423,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3427,7 +3431,7 @@ msgstr ""
 "testar pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3436,7 +3440,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3444,7 +3448,7 @@ msgstr ""
 "testar pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3453,7 +3457,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3461,7 +3465,7 @@ msgstr ""
 "testar pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3470,7 +3474,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3478,7 +3482,7 @@ msgstr ""
 "testar pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3487,26 +3491,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "okänd åtgärd\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "PAM-miljö:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - ingen miljö -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Ange en konfigurationsfil annan än standard"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Informerar att respondenten har blivit uttagsaktiverad"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Antal gånger att försöka ansluta till dataleverantörer"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Avaktivera netlink-gränssnittet"
 
diff --git a/po/tg.po b/po/tg.po
index ff61b5dd666..08314ffb37d 100644
--- a/po/tg.po
+++ b/po/tg.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:48-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Tajik (http://www.transifex.com/projects/p/sssd/language/"
@@ -45,26 +45,22 @@ msgid "Command to start service"
 msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -72,63 +68,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -136,1131 +132,1137 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr ""
@@ -1844,32 +1846,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr ""
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr ""
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1877,97 +1879,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Берун аз хотира\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -1999,140 +2001,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Паролҳо номувофиқанд"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Пароли нав:"
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Парол:"
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr ""
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2141,7 +2143,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr ""
 
@@ -2203,102 +2205,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2332,161 +2338,161 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2540,7 +2546,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2554,211 +2560,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2767,42 +2773,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2824,281 +2830,281 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 #, fuzzy
 msgid "attribute"
 msgstr "Аттрибути GID"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3161,19 +3167,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3182,121 +3188,121 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr ""
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
diff --git a/po/tr.po b/po/tr.po
index 06d6fdfe266..13678686112 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2023-06-04 04:20+0000\n"
 "Last-Translator: Kemal Oktay Aktoğan <oktay@e.email>\n"
 "Language-Team: Turkish <https://translate.fedoraproject.org/projects/sssd/"
@@ -49,28 +49,24 @@ msgid "Command to start service"
 msgstr "Hizmeti başlatma komutu"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Veri sağlayıcılara bağlanma girişimi sayısı"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "Bu yanıtlayıcı tarafından açılabilecek dosya tanımlayıcılarının sayısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 "İstemci bağlantısının otomatik olarak kesilmesinden önceki boşta geçen süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Yanıtlayıcının otomatik kapanmasından önceki boşta geçen süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 "Veri sağlayıcıları sorgulamadan önce her zaman tüm önbellekleri sorgula"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -82,23 +78,23 @@ msgstr ""
 "cinsindendir ve şu şekilde hesaplanır: çevrim_dışı_zaman_aşımı + "
 "rastgele_ofset."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Başlatılacak SSSD hizmetleri"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Başlatılacak SSSD etki alanları"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Kullanıcı adını ve etki alanını ayrıştırmak için düzenli ifade"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Tam nitelikli adları görüntülemek için printf uyumlu biçim"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -106,38 +102,38 @@ msgstr ""
 "SSSD'nin Kerberos yeniden oynatma önbellek dosyalarını depolaması gereken "
 "dosya sistemindeki dizin."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Etki alanı bileşeni olmayan adlara eklenecek etki alanı."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Ayrıcalıkların bırakılacağı kullanıcı"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Sertifika doğrulamasını ayarla"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Grup veya kullanıcı adlarındaki tüm boşluklar bu karakterle değiştirilecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 "Netlink durum değişikliklerini dikkate almak veya yok saymak için sssd'yi "
 "ayarla"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Öntanımlı dosyalar etki alanını etkinleştir veya devre dışı bırak"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Aranacak etki alanlarının belirli bir sırası"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -145,7 +141,7 @@ msgstr ""
 "SSSD'nin dahili DNS çözümleyicisini ne zaman güncellemesi gerektiğini "
 "belirlemek için resolv.conf durumunu izlemesi gerekip gerekmediğini denetler."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -157,82 +153,82 @@ msgstr ""
 "inotify kullanmayı deneyeceğiz ve inotify kullanılamıyorsa bunun yerine her "
 "beş saniyede bir resolv.conf'u sorgulamayı kullanacağız."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 "AD ve IPA sağlayıcısı için PAC yanıtlayıcısını otomatik olarak çalıştırın"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 "Tüm SSSD işlemleri için çekirdek dökümlerini etkinleştirin veya devre dışı "
 "bırakın."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Geçiş anahtarı doğrulama davranışını ayarlayın"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Numaralandırma önbelleği zaman aşımı uzunluğu (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Girdi önbelleği arka planda güncelleme zaman aşımı uzunluğu (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Negatif önbellek zaman aşımı uzunluğu (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Dosyalar negatif önbellek zaman aşımı uzunluğu (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "SSSD'nin açıkça yok sayması gereken kullanıcılar"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "SSSD'nin açıkça yok sayması gereken gruplar"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Filtrelenen kullanıcılar gruplarda görünmeli mi"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "NSS sağlayıcısının döndürmesi gereken parola alanının değeri"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Kimlik sağlayıcıdan alınan homedir (ev dizini) değerini bu değerle geçersiz "
 "kıl"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Kimlik sağlayıcıdan alınan boş homedir (ev dizini) değerini bu değerle "
 "değiştir"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 "Kimlik sağlayıcıdan alınan shell (kabuk) değerini bu değerle geçersiz kıl"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Kullanıcıların oturum açmasına izin verilen kabukların listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "Reddedilecek ve yedek kabuk ile değiştirilecek kabukların listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -240,15 +236,15 @@ msgstr ""
 "Merkezi dizinde depolanan bir kabuğa izin veriliyor ancak kullanılamıyorsa, "
 "yedek olarak bunu kullan"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Sağlayıcı bir tane listelemiyorsa kullanılacak kabuk"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Bellek içi önbellek kayıtları ne kadar süreyle geçerli olacak"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -256,7 +252,7 @@ msgstr ""
 "passwd istekleri için hızlı bellek içi önbellek içinde ayrılan veri "
 "tablosunun boyutu (megabayt olarak)"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -264,7 +260,7 @@ msgstr ""
 "Grup istekleri için hızlı bellek içi önbellek içinde ayrılan veri tablosunun "
 "boyutu (megabayt olarak)"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -272,7 +268,7 @@ msgstr ""
 "initgroups istekleri için hızlı bellek içi önbellek içinde ayrılan veri "
 "tablosunun boyutu (megabayt olarak)"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -280,7 +276,7 @@ msgstr ""
 "Bu seçeneğin değeri, şablon %H biçim dizgesini içeriyorsa override_homedir "
 "seçeneğinin genişletilmesinde kullanılacaktır."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -288,7 +284,7 @@ msgstr ""
 "Alt etki alanı adları listesinin geçerli sayılacağı süreyi saniye cinsinden "
 "belirtir."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -298,18 +294,18 @@ msgstr ""
 "yüzdesinin ötesinde istenirse girdileri arka planda otomatik olarak "
 "güncelleyecek şekilde ayarlanabilir."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Çevrim içi oturum açma işlemleri arasında önbelleğe alınmış oturum açma "
 "işlemlerine ne kadar süreyle izin verilecek (gün)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 "Çevrim dışıyken kaç tane başarısız oturum açma girişimine izin verilecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -317,91 +313,91 @@ msgstr ""
 "offline_failed_login_attempts değerine ulaşıldıktan sonra oturum açmanın "
 "reddedileceği süre (dakika)"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "Kimlik doğrulama sırasında kullanıcıya ne tür mesajlar gösterilecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "pam_sss'ye gönderilen PAM yanıtlarını filtrele"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr "PAM istekleri için kimlik bilgileri kaç saniye önbellekte tutulacak"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "Parola süresinin dolmasına kaç gün kala bir uyarı görüntülenmeli"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Güvenilen kullanıcı kimliklerinin veya adlarının listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 "Güvenilmeyen kullanıcılar için bile erişilebilen etki alanı adlarının "
 "listesi."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "Kullanıcı hesabının süresi dolduğunda görüntülenen mesaj."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "Kullanıcı hesabı kilitlendiğinde görüntülenen mesaj."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Sertifika tabanlı/Akıllı kart kimlik doğrulamasına izin ver."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "PKCS#11 modüllerine sahip sertifika veri tabanının yolu."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "PAM kimlik doğrulaması için sertifika doğrulamasını ayarla."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "pam_sss, p11_child'in bitmesi için kaç saniye bekleyecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 "Hangi PAM hizmetlerinin uygulama etki alanlarıyla iletişim kurmasına izin "
 "verilecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Akıllı kartları kullanmak için izin verilen hizmetler"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "İstendiğinde kart beklemek için ek zaman aşımı"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "Akıllı kart kimlik doğrulaması için aygıt seçimini kısıtlamak için PKCS#11 "
 "URI'si"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "PAM yanıtlayıcısı bir initgroups talebini ne zaman zorlayacak"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 "GSSAPI ile kimlik doğrulamasına izin verilen PAM hizmetlerinin listesi."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "Kimliği doğrulanmış UPN'nin hedef kullanıcıyla eşleşip eşleşmeyeceği"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -409,29 +405,29 @@ msgstr ""
 "GSSAPI kimlik doğrulaması ile PAM erişimi için zorunlu kılınması gereken "
 "<PAM hizmeti>:<kimlik doğrulama göstergesi> çiftlerinin listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Geçiş anahtarı cihaz kimlik doğrulamasına izin ver."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "pam_sss, p11_child'in bitmesi için kaç saniye bekleyecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "libfido2 kitaplığında hata ayıklamayı etkinleştir"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 "Sudo kurallarında zamana dayalı özniteliklerin değerlendirilip "
 "değerlendirilmeyeceği"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "Doğruysa, SSSD düşük kazançlı sıralama mantığına geri dönecek"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -439,13 +435,13 @@ msgstr ""
 "Tek seferde yenilenebilecek azami kural sayısı. Bu aşılırsa, tam yenileme "
 "gerçekleştirilir."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 "known_hosts dosyasında ana bilgisayar adlarının ve adreslerinin karılıp "
 "karılmayacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -453,15 +449,15 @@ msgstr ""
 "Ana bilgisayar anahtarları istendikten sonra bir ana bilgisayarın "
 "known_hosts dosyasında kaç saniye tutulacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Güvenilir CA sertifikalarının depolanmasına giden yol"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Sertifikalardan ssh anahtarları oluşturmaya izin ver"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -469,26 +465,26 @@ msgstr ""
 "Ssh anahtarı üretimi için sertifikaları süzmede aşağıdaki eşleştirme "
 "kurallarını kullanın"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "PAC yanıtlayıcısına erişmesine izin verilen UID'lerin veya kullanıcı "
 "adlarının listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "PAC verilerinin ne kadar süreyle geçerli olduğu kabul edilir"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "PAC'yi doğrulayın"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 "InfoPipe'ın yayınlamasına izin verilen kullanıcı özniteliklerinin listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -499,7 +495,7 @@ msgstr ""
 "kullanıcılar/gruplar ve grup seçenekleri kaydedilir. all - Tüm kullanıcılar "
 "kaydedilir."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -509,7 +505,7 @@ msgstr ""
 "listesi. NSS tarafından döndürülen kullanıcı adlarıyla eşleşir. Yani olası "
 "alan değişiminden sonra, vaka değişiklikleri vb."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -519,7 +515,7 @@ msgstr ""
 "grup listesi. NSS tarafından döndürülen grup adlarıyla eşleşir. Yani olası "
 "alan değişiminden sonra, vaka değişiklikleri vb."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -527,7 +523,7 @@ msgstr ""
 "Yalnızca scope=all olduğunda kayıttan hariç tutulacak kullanıcıların "
 "virgülle ayrılmış listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -535,105 +531,105 @@ msgstr ""
 "Üyeleri yalnızca scope=all olduğunda kayıttan çıkarılması gereken virgülle "
 "ayrılmış grup listesi. "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Kimlik sağlayıcı"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Kimlik doğrulama sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Erişim denetimi sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Parola değiştirme sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Ana bilgisayar kimliği sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "SELinux sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Oturum yönetimi sağlayıcısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Çözümleyici sağlayıcı"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 "Etki alanının işletim sistemi veya uygulamalar tarafından kullanılabilir "
 "olup olmadığı"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Etki alanını etkinleştirin veya devre dışı bırakın"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "En düşük kullanıcı kimliği"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "En yüksek kullanıcı kimliği"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Tüm kullanıcıları/grupları numaralandırmayı etkinleştir"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Çevrimdışı oturum açma için önbellek kimlik bilgileri"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Kullanıcıları/grupları tam nitelikli(FQDN) biçimde görüntüleyin"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Grup aramalarına grup üyelerini dahil etme"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Girdi önbelleği zaman aşımı uzunluğu (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "DNS aramaları gerçekleştirirken belirli bir adres ailesini kısıtlayın veya "
 "tercih edin"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Son başarılı oturum açma işleminden sonra önbelleğe alınmış girişlerin ne "
 "kadar süreyle saklanacağı (gün)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -641,20 +637,20 @@ msgstr ""
 "SSSD, bir sonraki sunucuyu denemeden önce tek DNS sunucusuyla ne kadar "
 "konuşmalı (milisaniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "Tek bir DNS sorgusunu çözmeye ne kadar süre devam etmeli (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Sunucuları çözümlerken DNS'den gelen yanıtların ne kadar bekleneceği (saniye)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Hizmet keşfi DNS sorgusunun etki alanı kısmı"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -664,109 +660,109 @@ msgstr ""
 "sunucuya yeniden bağlanmayı denemeden önce bekleyeceği aralığı saniye "
 "cinsinden belirtir"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "Kimlik sağlayıcıdan alınan GID değerini bu değerle geçersiz kıl"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Kullanıcı adlarını büyük/küçük harfe duyarlı olarak ele alın"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Süresi dolan girişler arka planda ne sıklıkla yenilenmelidir"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr "Arka planda süresi dolmuş girişleri yenilerken azami dönem sapması"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "İstemcinin DNS girişinin otomatik olarak güncellenip güncellenmeyeceği"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "Güncelledikten sonra istemcinin DNS girdisine uygulanacak TTL"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "Dinamik DNS güncellemeleri için IP'sinin kullanılması gereken arayüz"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "İstemcinin DNS girdisini periyodik olarak güncelleme sıklığı"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "İstemcinin DNS girdisini güncellerken azami dönem sapması"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "Sağlayıcının PTR kaydını da açıkça güncellemesi gerekip gerekmediği"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 "nsupdate yardımcı programının varsayılan olarak TCP kullanması gerekip "
 "gerekmediği"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "DNS güncellemesini gerçekleştirmek için ne tür bir kimlik doğrulama "
 "kullanılmalıdır"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 "DNS güncellemesini gerçekleştirmek için kullanılan DNS sunucusunu geçersiz "
 "kılın"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Güvenilen etki alanlarının numaralandırmasını denetleyin"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Alt etki alanı listesi ne sıklıkla yenilenmelidir"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "Alt etki alanı listesini yenilerken azami dönem sapması"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Bir alt etki alanına devralınması gereken seçeneklerin listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Varsayılan alt etki alanı homedir değeri"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Önbelleğe alınmış kimlik bilgileri, kimlik doğrulama için ne kadar süreyle "
 "kullanılabilir"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 "Kullanıcılar için otomatik olarak özel gruplar oluşturulup oluşturulmayacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "Parolanın süresi dolmadan N gün önce bir uyarı görüntüleyin."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Bu etki alanı için realmd yapılandırma hizmeti tarafından depolanan çeşitli "
 "etiketler."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -774,7 +770,7 @@ msgstr ""
 "Alt etki adlarının alınmasını işlemesi gereken sağlayıcı. Bu değer her zaman "
 "id_provider ile aynı olmalıdır."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -782,7 +778,7 @@ msgstr ""
 "Yenilemeden sonra bir ana bilgisayar ssh anahtarının kaç saniye tutulacağı. "
 "Yani, ana bilgisayar anahtarının ne kadar süreyle önbelleğe alınacağı."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -793,42 +789,42 @@ msgstr ""
 "süreli parola) önbelleğe SHA512 karma olarak kaydedilmesi gereken asgari "
 "uzunluğu belirler."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Yerel kimlik doğrulama yöntemleri ilkesi "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA etki alanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA sunucu adresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Yedek IPA sunucusunun adresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA istemcisi ana bilgisayar adı"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "FreeIPA'da istemcinin DNS girdisinin otomatik olarak güncellenip "
 "güncellenmeyeceği"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "HBAC ile ilgili nesneler için arama tabanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "IPA sunucusuna karşı HBAC kurallarının aranması arasındaki süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
@@ -836,62 +832,62 @@ msgstr ""
 "IPA sunucusuna karşı SELinux eşlemelerinin aranması arasındaki saniye "
 "cinsinden süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "false olarak ayarlanırsa, PAM tarafından verilen ana bilgisayar argümanı yok "
 "sayılır"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "Bu IPA istemcisinin kullandığı automounter konumu"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "IPA etki alanı hakkında bilgi içeren nesne için arama tabanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "Kimlik aralıkları hakkında bilgi içeren nesneler için arama tabanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "DNS sitelerini etkinleştirin - konuma dayalı hizmet keşfi"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Görünüm kapsayıcıları için arama tabanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Görünüm kapsayıcıları için nesne sınıfı"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Görünümün adıyla birlikte öznitelik"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Geçersiz kılma nesneleri için nesne sınıfı"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Asıl nesneye kıyasla öznitelik"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Kullanıcı geçersiz kılma nesneleri için nesne sınıfı"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Grup geçersiz kılma nesneleri için nesne sınıfı"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Masaüstü Profili ile ilgili nesneler için arama tabanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
@@ -899,7 +895,7 @@ msgstr ""
 "IPA sunucusuna karşı Masaüstü Profili kurallarının aranması arasındaki "
 "saniye cinsinden süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -907,42 +903,42 @@ msgstr ""
 "Son istek herhangi bir kural bulamadığı zaman, IPA sunucusuna karşı Masaüstü "
 "Profilleri kurallarının aranması arasındaki dakika cinsinden süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "SUBID aralıkları için arama tabanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "Erişim denetimini değerlendirmek için hangi kurallar kullanılmalıdır"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "Ana bilgisayarın FQDN'sini içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "LDAP'daki bir ana bilgisayar girdisinin nesne sınıfı."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 "Ana bilgisayar nesneleri için arama tabanı olarak verilen dizeyi kullanın."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "Ana bilgisayarın SSH ortak anahtarlarını içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "Ağ grubunun NIS alan adını içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "Ağ grubunun üyelerinin adlarını içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -950,7 +946,7 @@ msgstr ""
 "Ağ grubunun üyesi olan ana bilgisayarların ve ana bilgisayar gruplarının "
 "FQDN'lerini listeleyen LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -958,11 +954,11 @@ msgstr ""
 "Ağ grubunun doğrudan üyeleri olan ana bilgisayarları ve ana bilgisayar "
 "gruplarını listeleyen LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "Ağ grubunun üyeliklerini listeleyen LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -970,20 +966,20 @@ msgstr ""
 "Ağ grubunun doğrudan üyeleri olan sistem kullanıcıları ve grupları "
 "listeleyen LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "Ağ grubu adına karşılık gelen LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "LDAP'daki bir ağ grubu girdisinin nesne sınıfı."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "Bir LDAP ağ grubu nesnesinin UUID/GUID'sini içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -991,11 +987,11 @@ msgstr ""
 "Kullanıcı eşlemesinin kullanım için etkin olup olmadığını içeren LDAP "
 "özelliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "\"all\" gibi ana bilgisayar sınıfını içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -1003,17 +999,17 @@ msgstr ""
 "Bu kuralın eşleştiği tüm ana bilgisayarları/ana bilgisayar gruplarını içeren "
 "LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "Bu kuralın eşleştiği tüm kullanıcıları/grupları içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "SELinux kullanıcı eşlemesinin adını içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -1021,19 +1017,19 @@ msgstr ""
 "memberUser ve memberHost yerine eşleştirme için kullanılabilen HBAC "
 "kuralının DN'sini içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "SELinux kullanıcı dizesinin kendisini içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "\"all\" gibi kullanıcı sınıfını içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "Kullanıcı eşlemesinin benzersiz kimliğini içeren LDAP özniteliği."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1042,58 +1038,58 @@ msgstr ""
 "alanlarından kullanıcı ve grupların aramalarını farklı şekilde "
 "gerçekleştirmesi gerektiğini belirtir."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 "Verilen dizeyi güvenilir etki alanları için arama tabanı olarak kullanın."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Active Directory etki alanı"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Etkinleştirilmiş Active Directory etki alanları"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Active Directory sunucu adresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Active Directory yedek sunucu adresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Active Directory istemci ana bilgisayar adı"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Erişim ayrıcalıklarını belirlemek için LDAP süzgeci"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Aramalar için Genel Kataloğun kullanılıp kullanılmayacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "GPO tabanlı erişim kontrolü için çalışma kipi"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "AD sunucusuna karşı GPO ilke dosyalarının aranması arasındaki süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 "GPO (Deny)InteractiveLogonRight ilke ayarlarıyla eşleşen PAM hizmet adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1101,283 +1097,283 @@ msgstr ""
 "GPO (Deny)RemoteInteractiveLogonRight ilke ayarlarıyla eşleşen PAM hizmet "
 "adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr "GPO (Deny)NetworkLogonRight ilke ayarlarıyla eşleşen PAM hizmet adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr "GPO (Deny)BatchLogonRight ilke ayarlarıyla eşleşen PAM hizmet adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr "GPO (Deny)ServiceLogonRight ilke ayarlarıyla eşleşen PAM hizmet adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "GPO tabanlı erişimin her zaman verildiği PAM hizmet adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "GPO tabanlı erişimin her zaman reddedildiği PAM hizmet adları"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Eşlenmemiş PAM hizmet adları için kullanmak üzere varsayılan oturum açma "
 "hakkı (veya izin verme/reddetme)"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "istemci tarafından kullanılacak hususi bir alan"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Makine hesabı parolasının yenilenmesinden önceki gün cinsinden azami zaman"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "Makine hesabı yenileme görevini ayarlama seçeneği"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 "Samba veritabanında makine hesabı parolasının güncellenip güncellenmeyeceği"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "LDAP ve Genel Katalog istekleri için LDAPS bağlantı noktasını kullanın"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "Diğer etki alanlarından etki alanı yerel gruplarını süzmeyin"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos sunucu adresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Kerberos yedek sunucu adresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos bölgesi(realm)"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Kimlik doğrulama zaman aşımı"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "kdcinfo dosyalarının oluşturulup oluşturulmayacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "krb5 yapılandırma parçacıkları nereye bırakılır"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Kimlik bilgileri önbelleklerini depolamak için dizin"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Kullanıcının kimlik bilgileri önbelleğinin konumu"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Kimlik bilgilerini doğrulamak için anahtarın(keytab) konumu"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Kimlik doğrulamasını etkinleştir"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 "Çevrimdışıysa daha sonra çevrimiçi kimlik doğrulama için parolayı saklayın"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "TGT'nin yenilenebilir ömrü"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "TGT'nin ömrü"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Yenileme için iki denetim arasındaki süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "FAST'ı etkinleştirir"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "FAST için kullanım ilkesini seçin"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "FAST kimlik bilgilerini istemek için anonim PKINIT kullanın"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Temel kurallılaştırmayı etkinleştirir"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Kurumsal ilkeleri etkinleştirir"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Kimlik doğrulama için alt etki alanlarının kullanılmasını sağlar"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "Kullanıcı adlarından Kerberos asıl adlarına bir eşleme"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "KDC'de değilse parola değiştirme hizmetinin çalıştığı sunucu"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, LDAP sunucusunun URI'si"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, LDAP sunucusunun URI'si"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Varsayılan taban DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "LDAP sunucusunda kullanılan Şema Türü, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Kullanıcı parolasını değiştirmek için kullanılan kip"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Varsayılan bağlama DN'si"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Varsayılan bağlama DN'sinin kimlik doğrulama belirtecinin türü"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Varsayılan bağlama DN'sinin kimlik doğrulama belirteci"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Bağlantı kurma süresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Eşzamanlı LDAP işlemlerini deneme süresi"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "Çevrimdışıyken yeniden bağlanma girişimleri arasındaki süre"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Bölge(realm) adları için yalnızca büyük harf kullanın"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "CA sertifikalarını içeren dosya"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "CA sertifika dizinine giden yol"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "İstemci sertifikasını içeren dosya"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "İstemci anahtarını içeren dosya"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Olası şifre paketlerinin listesi"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "TLS sertifika doğrulaması iste"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Kullanılacak sasl mekanizmasını belirtin"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Kullanılacak sasl yetkilendirme kimliğini belirtin"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Kullanılacak sasl yetkilendirme bölgesini(realm) belirtin"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "LDAP sasl yetkilendirmesi için asgari SSF'yi belirtin"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "LDAP sasl yetkilendirmesi için azami SSF'yi belirtin"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Kerberos hizmet anahtarı(keytab)"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "LDAP bağlantısı için Kerberos yetkilendirmesini kullanın"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "LDAP yönlendirmelerini takip edin"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "LDAP bağlantısı için TGT'nin ömrü"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Takma adlar nasıl kaldırılır"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "DNS hizmeti aramaları için hizmet adı"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Tek bir LDAP sorgusunda alınacak kayıt sayısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr "Tam bir başvuruyu tetiklemek için eksik olması gereken üye sayısı"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Okunamayan LDAP başvurularını yoksay"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1385,7 +1381,7 @@ msgstr ""
 "LDAP kitaplığının, SASL bağlaması sırasında ana bilgisayar adını standart "
 "hale getirmek için geriye doğru arama yapıp yapmayacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1393,32 +1389,38 @@ msgstr ""
 "RFC2307 şemasını kullanan sunucular için yerel kullanıcıları LDAP grubunun "
 "üyeleri olarak tutmaya izin verir."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN özniteliği"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN özniteliği"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 "LDAP sunucusuyla bağlantıyı kesmeden önce bağlantının ne kadar süreyle "
 "korunacağı"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "LDAP sayfalama denetimini devre dışı bırakın"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Active Directory aralığı almayı devre dışı bırakın"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "ppolicy uzantısını kullan"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Arama isteğini bekleme süresi"
@@ -2025,34 +2027,34 @@ msgstr "Parola dosya kaynaklarının yolu."
 msgid "Path of group file sources."
 msgstr "Grup dosya kaynaklarının yolu."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr "Yapılandırma işlemi başarısız oldu\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr "'"
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 "Desteklenmeyen değer '%s' ('%s' yapılandırma seçeneği için)! Yalnızca 'root' "
 "veya '"
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Bir arkaplan hizmeti ol (varsayılan)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Etkileşimli çalıştır (arkaplan programı değil)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Sürüm numarasını yazdırın ve çıkın"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -2063,99 +2065,99 @@ msgstr ""
 "Geçersiz seçenek %s: %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "-i|--interactive seçeneğine -D|--daemon ile birlikte izin verilmez\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr "Başlangıç yetenekleri alınamadı\n"
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 "Yetkili (root) olmayan hizmet kullanıcısı desteği oluşturulmadı. % altında "
 "çalıştırılamaz"
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr "Yapılandırma okunamıyor: '%s'\n"
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr "SSSD 'monitor' işlemi başlatılamadı: %s"
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Yetersiz bellek!\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Çekirdek dökümlerine izin ver"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Hata ayıklama günlükleri için açık bir dosya tanımlayıcısı"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "Kullanıcı olarak FAST ccache oluştur"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Grup olarak FAST ccache oluştur"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "FAST kimlik bilgilerini istemek için anonim PKINIT kullanın"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Kullanılacak Kerberos bölgesi"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Biletin talep edilen kullanım ömrü"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Biletin talep edilen yenilenebilir kullanım ömrü"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "FAST seçenekleri ('never', 'try', 'demand')"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "FAST için kullanılacak sunucu sorumlusunu belirtir"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Ana adın standartlaştırılmasını ister"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "krb5_get_init_creds_password'ün özel sürümünü kullanın"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "Günlük kaydı amacıyla kullanılan olay zinciri kimliği"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "PAC bayraklarını denetleyin"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf başarısız oldu.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd başarısız oldu.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Bilgi sağlayıcısının etki alanı (zorunlu)"
 
@@ -2187,16 +2189,16 @@ msgstr "Bir hata oluştu, ancak açıklama bulunamadı."
 msgid "Unexpected error while looking for an error description"
 msgstr "Hata açıklaması aranırken beklenmeyen hata"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "İzin reddedildi. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Sunucu iletisi: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
@@ -2204,50 +2206,50 @@ msgstr ""
 "Kerberos TGT oturum açma sırasında verilmeyecek, kullanıcı deneyimi "
 "etkilenecektir."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "PIN girin:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Parolalar eşleşmiyor"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Yönetici tarafından parola sıfırlama desteklenmez."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Önbelleğe alınmış kimlik bilgileriyle doğrulandı"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", önbelleğe alınmış parolanızın süresi şu tarihte sona erecek: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Parolanızın süresi doldu. %1$d ek oturum açma hakkınız kaldı."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Parolanızın süresi %1$d %2$s içinde dolacak."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Parolanızın süresi doldu."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Kimlik doğrulama şu ana kadar reddedilir: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Sistem çevrimdışı, şifre değişikliği mümkün değil"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2255,11 +2257,11 @@ msgstr ""
 "OTP şifresini değiştirdikten sonra bilet almak için oturumu kapatıp tekrar "
 "açmanız gerekir"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN kilitli"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2267,66 +2269,66 @@ msgstr ""
 "Sunucu bu yöntemi desteklemediği için Kerberos TGT verilmedi. Ortak oturum "
 "açma (SSO) deneyiminiz etkilenecektir."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Parola değişikliği başarısız oldu. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "%1$s'de kimlik doğrulaması yapın ve ENTER'a basın."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "%2$s'de %1$s PIN'i ile kimlik doğrulaması yapın ve ENTER'a basın."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "Lütfen (farklı bir) Akıllı Kartı (yeniden) yerleştirin"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Yeni Parola: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Yeni parolayı tekrar giriniz: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Birinci Etken: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "İkinci Etken (isteğe bağlı): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "İkinci Etken: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "Geçiş anahtarı aygıtınızı girin ve ardından ENTER'a basın."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Parola: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Birinci Etken (Geçerli Parola): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Geçerli Parola: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Parolanızın zamanı doldu. Parolanızı şimdi değiştirin."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Çalıştırılacak hata ayıklama düzeyi"
 
@@ -2335,7 +2337,7 @@ msgstr "Çalıştırılacak hata ayıklama düzeyi"
 msgid "The SSSD domain to use"
 msgstr "Kullanılacak SSSD etki alanı"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Yerel ayar yapılırken hata oluştu\n"
 
@@ -2406,85 +2408,89 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: %s ana bilgisayar adı çözülemedi\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Belirtilen aramayla eşleşen önbellek nesnesi yok\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "%1$s geçersiz kılınamadı\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "%1$s %2$s geçersiz kılınamadı\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Tüm önbelleğe alınmış girdileri geçersiz kıl"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Belirli bir kullanıcıyı geçersiz kıl"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Tüm kullanıcıları geçersiz kıl"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Belirli bir grubu geçersiz kıl"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Tüm grupları geçersiz kıl"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Belirli ağ grubunu geçersiz kıl"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Tüm ağ gruplarını geçersiz kıl"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Belirli bir hizmeti geçersiz kıl"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Tüm hizmetleri geçersiz kıl"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Belirli autofs eşlemesini geçersiz kıl"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Tüm autofs eşlemelerini geçersiz kıl"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Belirli SSH ana bilgisayarını geçersiz kıl"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Tüm SSH ana bilgisayarlarını geçersiz kıl"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Belirli sudo kuralını geçersiz kıl"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Önbelleğe alınmış tüm sudo kurallarını geçersiz kıl"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Yalnızca belirli bir etki alanından girdileri geçersiz kıl"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2492,11 +2498,11 @@ msgstr ""
 "Beklenmeyen bağımsız değişken(ler) sağlandığında, tek bir nesneyi geçersiz "
 "kılan seçenekler yalnızca sağlanan tek bir bağımsız değişkeni kabul eder.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "Lütfen geçersiz kılmak için en az bir nesne seçin\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2505,7 +2511,7 @@ msgstr ""
 "%1$s etki alanı açılamadı. Etki alanı bir alt etki alanıysa (güvenilen etki "
 "alanı) --domain/-d parametresi yerine tam nitelikli adı(FQDN) kullanın.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Kullanılabilir etki alanları açılamadı\n"
 
@@ -2539,163 +2545,163 @@ msgstr "Kullanıcı girişi okunamıyor\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Geçersiz giriş, lütfen '%s' veya '%s' girin.\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Harici komut yürütülürken hata\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "'%s' harici komutu yürütülürken hata oluştu\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "'%s' komutu [%d] ile başarısız oldu.\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "SSSD'nin çalışıyor olması gerekir. SSSD şimdi başlatılsın mı?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "SSSD çalışmıyor olmalıdır. SSSD şimdi durdurulsun mu?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 "SSSD'nin yeniden başlatılması gerekiyor. SSSD şimdi yeniden başlatılsın mı?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "SSSD Durumu:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Kullanılabilir etki alanlarını listeleyin"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Etki alanı hakkında yazdırma bilgileri"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 "Bir kullanıcı hakkında bilgi yazdırın ve kimlik doğrulamasını denetleyin"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Bir etki alanı için erişim raporu oluştur"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Etkin sunucu hakkında bilgi göster:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Önbelleğe alınan kullanıcı hakkında bilgi"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Önbelleğe alınan grup hakkında bilgi"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Önbelleğe alınmış ağ grubu hakkında bilgi"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Yerel veri araçları:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Yerel verileri yedekle"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Yerel verileri yedekten geri yükleyin"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "Yerel verileri yedekleyin ve önbelleğe alınmış içeriği kaldırın"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Önbelleğe alınmış nesneleri geçersiz kıl"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Önbellek dizinlerini yönet"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Günlük dosyaları araçları:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Mevcut SSSD günlük dosyalarını kaldırın"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "SSSD günlük dosyalarını tarball'da arşivleyin"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "SSSD hata ayıklama düzeyiyle ilgili bilgileri değiştirin veya yazdırın"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Günlüğe kaydedilen verileri inceleyin"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Yapılandırma dosyaları araçları:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "SSSD yapılandırmasının sabit incelemesini gerçekleştirin"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Sertifikayla ilgili araçlar:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Sertifikayla ilgili bilgileri yazdırın"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Sertifikayla eşlenen kullanıcıları göster"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Eşleme ve eşleştirme kuralını bir sertifikayla denetleyin"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr "GPO'larla ilgili araçlar:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr "Önbelleğe alınan GPO hakkında bilgi"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr "Önbelleğe alınan GPO'ları numaralandır"
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr "Önbelleğe alınan GPO'yu kaldır"
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr "Önbelleğe alınan tüm GPO'ları kaldır"
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Geçiş anahtarıyla ilgili araçlar:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "Geçiş anahtarıyla ilgili işlemleri gerçekleştirin"
 
@@ -2749,7 +2755,7 @@ msgstr "İlke sürümü"
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Hata: [%d] nesnesi alınamadı: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: [%d] değeri okunamıyor: %s\n"
@@ -2763,99 +2769,99 @@ msgstr "İsim belirtin."
 msgid "Unable to parse name %s.\n"
 msgstr "%s adı ayrıştırılamıyor.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "SID'ye göre ara"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Kullanıcı kimliğine göre ara"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Başlangıç grupları sona erme süresi"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Grup kimliğine göre ara"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr "GPO GUID'ye göre ara"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Komut satırı ayrıştırılamadı: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr "%s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Nesne yazdırılamadı: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr "talloc başarısız oldu.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr "Öznitelik listesi alınamıyor!\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr "Filtre oluşturulamıyor\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr "%s [%s]:\n"
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr "GPO'ların temel DN'si alınamıyor\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "sysdb aranamıyor: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "İleti sysdb özniteliklerine dönüştürülemiyor: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr "\t%s: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr "GPO girdisinden GUID özniteliği bulunamadı\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr "GPO girdisinden açıklama özniteliği bulunamadı\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr "GPO girdisi önbellekten silinemedi\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
@@ -2864,112 +2870,112 @@ msgstr ""
 "GPO yolu henüz önbellekte depolanmadı. Lütfen dosyaları [%s] içinden elle "
 "kaldırın\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr "[%s] için gerçek yol belirlenemedi: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr "Önbelleğe alınan GPO yolu [%s], [%s] altında değil, yok sayılıyor.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "İndirilen GPO dosyaları kaldırılamıyor: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Önbellek girdisi alınamadı: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr "Nesne etki alanı belirlenemedi\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr "GPO girdisinde GUID özniteliği bulunamadı\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "GPO silinemedi: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr "%s önbellekten kaldırıldı\n"
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Hata ayıklama bilgilerini göster"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "base64 kodlu sertifikayı belirtin."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "Sistem veriyoluna bağlanılamıyor!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - eşlenen kullanıcı bulunamadı -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "eşleme kuralı"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Eşleştirme kuralı"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Komut bağımsız değişkenleri ayrıştırılamıyor\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Yetersiz bellek!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Sertifika eşlemesi bağlamı ayarlanamadı.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr "[%d][%s] hatasıyla eşleme ve eşleştirme kuralları eklenemedi.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "base64 dizesinin kodu çözülemedi.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Sertifika kuralıyla eşleşir.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Sertifika kuralla eşleşmiyor.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "[%d][%s] ile eşleşen sertifika sırasında hata oluştu.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "[%d][%s] eşleme süzgeci oluşturulamadı.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2982,7 +2988,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2993,35 +2999,35 @@ msgstr ""
 "my/path/sssd.conf\" olarak ayarlanmışsa, parçacık dizini olarak \"/my/path/"
 "conf.d\" kullanılır)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "%1$s dosyası yok.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "Yapılandırma yok..\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "'%s' okunamadı: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Doğrulayıcılar çalıştırılamadı"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Doğrulayıcılar tarafından tanımlanan sorunlar: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Yapılandırma birleştirme sırasında oluşturulan iletiler: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Kullanılan yapılandırma parçacığı dosyaları: %zu\n"
@@ -3043,100 +3049,100 @@ msgstr "Kullanıcı geçersiz kılmaları dışa aktarılamıyor\n"
 msgid "Unable to export group overrides\n"
 msgstr "Grup geçersiz kılmaları dışa aktarılamıyor\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Mevcut yedeklemeyi geçersiz kıl"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Kullanıcı geçersiz kılmaları içe aktarılamıyor\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Grup geçersiz kılmaları içe aktarılamıyor\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Çalışmıyorsa SSSD'yi başlatın"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Verileri içe aktardıktan sonra SSSD'yi yeniden başlatın"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Temiz önbellek dosyaları oluşturun ve yerel verileri içe aktarın"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Önbelleği kaldırmadan önce SSSD'yi durdurun"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Önbellek kaldırıldığında SSSD'yi başlatın"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Yerel verilerin yedeği oluşturuluyor...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr "Yerel verilerin yedeği oluşturulamıyor, önbellek kaldırılamıyor.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Önbellek dosyaları kaldırılıyor...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Önbellek dosyaları kaldırılamıyor\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Yerel veriler geri yükleniyor...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "%1$s etki alanı için önbellek dizini oluşturuluyor\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "%1$s etki alanı için önbellek dizini siliniyor\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "%1$s etki alanı için dizinler:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Öznitelik: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Belirli bir etki alanı hedefleyin"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "etki alanı"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Dizine öznitelik"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "öznitelik"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "İşlem sağlanmadı\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3145,182 +3151,182 @@ msgstr ""
 "Bilinmeyen işlem: %1$s\n"
 "Geçerli eylemler: \"%2$s\", \"%3$s ve \"%4$s\"\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Öznitelik (-a) sağlanmadı\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "%1$s özniteliği dizine eklenmedi.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "%1$s özelliği zaten dizine eklendi.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Dizin işlemi başarısız oldu: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "Uzak sağlayıcılardaki dizinleri de güncellemeyi unutmayın.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 "Birincil veya güvenilen etki alanı türü de dahil olmak üzere etki alanı "
 "listesini göster"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "Çevrimiçi"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Çevrimdışı"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Çevrimiçi durum: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "Bu etki alanının etkin sunucusu yok.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Etkin sunucular:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "bağlı değil"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Sunucu bulunamadı.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "%s sunucu keşfedildi:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Şimdiye kadar hiçbiri.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Çevrimiçi durumu göster"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Etkin sunucu hakkında bilgi göster"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Keşfedilen sunucuların listesini göster"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Etki alanı adını belirtin."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Çevrimiçi durum alınamıyor\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Sunucu listesi alınamıyor\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD çalışmıyor.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Bilinmeyen etki alanı\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Erişilemeyen hizmet\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Kesmek yerine günlük dosyalarını silin"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Günlük dosyaları siliniyor...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Günlük dosyaları kaldırılamıyor\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Günlük dosyaları kesiliyor...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Günlük dosyaları kesilemiyor\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Günlük dosyaları %s içine arşivleniyor...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Günlük dosyaları arşivlenemiyor\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "SSSD hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "NSS hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "PAM hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "SUDO hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "AUTOFS hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "SSH hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "PAC hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "IFP hizmetini hedefleyin"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Ayarlamak istediğiniz hata ayıklama düzeyini belirtin"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "HATA: Olay zinciri kimliği desteği eksik, günlük çözümleyicisi "
@@ -3387,19 +3393,19 @@ msgstr ""
 " - kabuk: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "PAM eylemi [auth|acct|setc|chau|open|clos], varsayılan: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "PAM hizmeti, varsayılan: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Kullanıcı adını belirtin."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3412,22 +3418,22 @@ msgstr ""
 "hizmet: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "[%s] ile kullanıcı adı araması başarısız oldu.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "[%s] ile InfoPipe Kullanıcı araması başarısız oldu.\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start başarısız oldu: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3435,12 +3441,12 @@ msgstr ""
 "pam_authenticate deneniyor\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item başarısız oldu: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3449,7 +3455,7 @@ msgstr ""
 "[%s] kullanıcısı için pam_authenticate: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3457,7 +3463,7 @@ msgstr ""
 "pam_chauthtok deneniyor\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3466,7 +3472,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3474,7 +3480,7 @@ msgstr ""
 "pam_acct_mgmt deneniyor\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3483,7 +3489,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3491,7 +3497,7 @@ msgstr ""
 "pam_setcred deneniyor\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3500,7 +3506,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3508,7 +3514,7 @@ msgstr ""
 "pam_open_session deneniyor\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3517,7 +3523,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3525,7 +3531,7 @@ msgstr ""
 "pam_close_session deneniyor\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3534,26 +3540,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "bilinmeyen eylem\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "PAM Ortamı:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - ortam yok -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Varsayılan olmayan bir yapılandırma dosyası belirtin"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Yanıtlayıcının yuvayla(socket) etkinleştirildiğini bildirir"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Veri sağlayıcılara bağlanma girişimi sayısı"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "netlink arayüzünü devre dışı bırak"
 
diff --git a/po/uk.po b/po/uk.po
index 06beaf55b56..06329477704 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2024-06-27 05:36+0000\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <https://translate.fedoraproject.org/projects/sssd/"
@@ -56,27 +56,23 @@ msgid "Command to start service"
 msgstr "Команда запуску служби"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "Кількість повторних спроб встановлення з’єднання з надавачами даних"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "Кількість дескрипторів файлів, які може бути відкрито цим відповідачем"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 "Проміжок бездіяльності до автоматичного від’єднання клієнтської частини"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "Проміжок бездіяльності до автоматичного вимикання відповідача"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "Завжди опитувати усі кеші до опитування засобів надання даних"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -89,23 +85,23 @@ msgstr ""
 "значення вказується у секундах і обчислюється за такою формулою: "
 "час_очікування_від'єднання + випадкове_зміщення."
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "Служби SSSD, які слід запустити"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "Домени SSSD, які слід запустити"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "Формальний вираз для обробки імені користувача і домену"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "Сумісний з printf формат показу повних назв"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -113,36 +109,36 @@ msgstr ""
 "Каталог у файловій системі, де SSSD має зберігати файли кешу відтворення "
 "Kerberos."
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "Домен, який слід додати до назв без компонента домену."
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "Користувач, привілеї якого слід скинути"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "Скоригувати перевірку сертифікатів"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 "Усі пробіли у назвах груп і іменах користувачів буде замінено на цей символ"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "Налаштувати sssd на врахування або ігнорування змін стану netlink"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "Увімкнути або вимкнути домен неявних файлів"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "Певний порядок доменів, у якому їх слід використовувати для пошуку"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -150,7 +146,7 @@ msgstr ""
 "Керує тим, чи SSSD має спостерігати за станом resolv.conf для визначення "
 "моменту, коли слід оновити дані вбудованого інструмента визначення DNS."
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -162,78 +158,78 @@ msgstr ""
 "використовується inotify. У разі неможливості використання inotify, "
 "виконуватиметься опитування resolv.conf кожні п’ять секунд."
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "Запускати відповідач PAC автоматично для надавачів AD та IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "Увімкнути або вимкнути дампи ядра для усіх процесів SSSD."
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "Скоригувати поведінку при перевірці пароля"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "Тривалість часу очікування на дані кешу нумерування (у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "Час очікування на фонове оновлення кешу записів (у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "Від’ємний час очікування на дані з кешу (у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "Від’ємний час очікування на дані з кешу файлів (у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "Користувачі, яких SSSD має явно ігнорувати"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "Групи користувачів, які SSSD має явно ігнорувати"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "Чи слід показувати відфільтрованих користувачів у групах"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "Значення поля пароля, яке має повертати постачальник даних NSS"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 "Замінити значення назви домашнього каталогу від надавача профілю цим "
 "значенням"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 "Замінювати порожні значення домашніх каталогів у засобі надання даних "
 "профілів цим значенням"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "Замінити значення оболонки від надавача профілю цим значенням"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "Список оболонок, за допомогою яких можуть входити користувачі"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "Список оболонок, які буде заборонено і замінено резервною оболонкою"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
@@ -241,15 +237,15 @@ msgstr ""
 "Якщо оболонка, що зберігається у центральному каталозі дозволена, але "
 "недоступна, використовувати цю резервну"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "Оболонка, яку слід використовувати, якщо засіб не надає жодної"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "Строк дії записів кешу у пам’яті"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -257,7 +253,7 @@ msgstr ""
 "Розмір (у мегабайтах) таблиці даних, яку розміщено у швидкому кеші у "
 "пам'яті, для запитів passwd"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
@@ -265,7 +261,7 @@ msgstr ""
 "Розмір (у мегабайтах) таблиці даних, які розміщено у швидкому кеші у "
 "пам'яті, для запитів щодо груп"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -273,7 +269,7 @@ msgstr ""
 "Розмір (у мегабайтах) таблиці даних, які розміщено у швидкому кеші у "
 "пам'яті, для запитів щодо груп ініціалізації"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -281,7 +277,7 @@ msgstr ""
 "Значення цього параметра буде використано у розгортанні параметра "
 "override_homedir, якщо шаблон містить рядок форматування %H."
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -289,7 +285,7 @@ msgstr ""
 "Визначає час у секундах, протягом якого список піддоменів вважатиметься "
 "чинним."
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -299,17 +295,17 @@ msgstr ""
 "режимі, якщо запит щодо них надходить у визначений у відсотках від "
 "entry_cache_timeout для домену період часу."
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 "Тривалість зберігання кешованих реєстраційних даних між входами до системи "
 "(у днях)"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "Макс. дозволена кількість помилкових спроб входу у автономному режимі"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
@@ -317,103 +313,103 @@ msgstr ""
 "Тривалість (у хвилинах) заборони входу після досягнення значення "
 "offline_failed_login_attempts"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "Тип повідомлень, які буде показано користувачеві під час розпізнавання"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "Фільтрувати відповіді PAM, які надіслано pam_sss"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 "Тривалість (у секундах) зберігання даних щодо розпізнавання у кеші для "
 "запитів PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 "Визначає кількість днів між днем, коли має бути показано попередження, і "
 "днем, коли завершиться строк дії пароля"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "Список надійних UUID або імен користувачів"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 "Список доменів, доступ до яких відкрито навіть для ненадійних користувачів."
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 "Повідомлення, яке буде виведено, коли строк дії облікового запису "
 "користувача буде завершено."
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 "Повідомлення, яке буде виведено, коли обліковий запис користувача буде "
 "заблоковано."
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "Дозволити розпізнавання за сертифікатом або смарткарткою."
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "Шлях до бази даних сертифікатів із модулями PKCS#11."
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "Скоригувати перевірку сертифікатів для розпізнавання за допомогою PAM."
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 "Час у секундах, протягом якого pam_sss очікуватиме на завершення роботи "
 "p11_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 "Визначає, яким службам PAM дозволено встановлювати з'єднання із доменами "
 "програм"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "Дозволені служби для використання смарт-карток"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "Додатковий час очікування на картку, якщо надійде запит"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 "Адреса PKCS#11 для обмеження переліку пристроїв для розпізнавання за смарт-"
 "карткою"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 "Визначає, коли відповідач PAM має примусово виконувати запит щодо груп "
 "ініціалізації"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "Список служб PAM, яким дозволене розпізнавання за допомогою GSSAPI."
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 "Чи слід встановлювати відповідність розпізнаного UPN із користувачем "
 "призначення"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -421,33 +417,33 @@ msgstr ""
 "Список пар <служба PAM>:<індикатор розпізнавання>, для яких має бути "
 "примусово встановлено доступ PAM із розпізнаванням GSSAPI"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "Дозволити розпізнавання за допомогою пристрою пароля."
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 "Час у секундах, протягом якого pam_sss очікуватиме на завершення роботи "
 "passkey_child"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "Увімкнути діагностику у бібліотеці libfido2"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 "Визначає, чи слід обробляти атрибути правил sudo, пов’язані з часовими "
 "обмеженнями"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 "Якщо має значення true, SSSD перемикнеться на логіку упорядковування менший-"
 "кращий"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
@@ -455,11 +451,11 @@ msgstr ""
 "Максимальна кількість правил, які може бути одночасно оновлено. Якщо цю "
 "кількість буде перевищено, буде виконано повне оновлення."
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "Чи слід хешувати назви та адреси вузлів у файлі known_hosts"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
@@ -467,15 +463,15 @@ msgstr ""
 "Кількість секунд, протягом яких запису вузла зберігатиметься у файлі "
 "known_hosts після надсилання запиту щодо ключів вузла"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "Шлях до сховища надійних сертифікатів служб сертифікації (CA)"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "Дозволити створення ключів SSH з сертифікатів"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
@@ -483,25 +479,25 @@ msgstr ""
 "Використати вказані нижче відповідні правила для фільтрування сертифікатів "
 "для створення ключів SSH"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 "Список унікальних ідентифікаторів (UID) або імен користувачів, яким надано "
 "доступ до відповідача PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "Час, протягом якого дані PAC вважатимуться чинними"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "Перевірити PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "Список атрибутів запису користувача, які може оприлюднювати InfoPipe"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -511,7 +507,7 @@ msgstr ""
 "записувати жодного користувача.; some — записувати користувачів і групи, які "
 "вказано параметрами users і groups; all — записувати усіх користувачів."
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -522,7 +518,7 @@ msgstr ""
 "повернутими NSS, тобто після можливих замін пробілів, змін регістру символів "
 "тощо."
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -533,7 +529,7 @@ msgstr ""
 "назвами, повернутими NSS, тобто після можливих замін пробілів, змін регістру "
 "символів тощо."
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
@@ -541,7 +537,7 @@ msgstr ""
 "Список відокремлених комами облікових записів користувачів, яких має бути "
 "виключено з записування; лише якщо scope=all"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
@@ -549,105 +545,105 @@ msgstr ""
 "Список відокремлених комами записів груп, учасників яких має бути виключено "
 "з записування; лише якщо scope=all "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "Служба профілів"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "Служба розпізнавання"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "Служба керування доступом"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "Служба зміни паролів"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "Служба SUDO"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Служба автоматизації файлових систем"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "Служба профілів вузлів"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "Надавач даних SELinux"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "Засіб керування сеансами"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "Надавач даних визначення адрес"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 "Визначає, чи можна використовувати домен у операційній системі або у "
 "програмах"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "Увімкнути або вимкнути домен"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "Мін. ідентифікатор користувача"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "Макс. ідентифікатор користувача"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "Увімкнути нумерацію всіх користувачів/груп"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "Кешувати реєстраційні дані для автономного входу"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "Показувати записи користувачів/груп повністю"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "Не включати учасників групи у пошуки групи"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "Тривалість кешування записів (у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 "Обмежити або надавати перевагу певному сімейству адрес під час виконання "
 "пошуків DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 "Тривалість зберігання кешованих записів після останнього успішного входу (у "
 "днях)"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
@@ -655,21 +651,21 @@ msgstr ""
 "Гранична тривалість спроби обмінятися даними SSSD з окремим сервером DNS, "
 "перш ніж програма спробує наступний сервер (у мілісекундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "Гранична тривалість спроби обробки окремого запиту DNS (у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 "Тривалість очікування на відповідь від DNS під час визначення адрес серверів "
 "(у секундах)"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "Частина запиту щодо виявлення служби DNS, пов’язана з доменом"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
@@ -679,116 +675,116 @@ msgstr ""
 "повторного з'єднання із основним сервером після успішного встановлення "
 "з'єднання із резервним сервером"
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 "Замінити значення ідентифікатора групи від надавача профілю цим значенням"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "Враховувати регістр у іменах користувачів"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "Наскільки часто має виконувати оновлення у тлі застарілих записів"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 "Максимальне відхилення періоду при оновленні прострочених записів у фоновому "
 "режимі"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "Визначає, чи слід автоматично оновлювати запис DNS клієнта"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 "TTL, який слід застосовувати до запису DNS клієнта після його оновлення"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 "Інтерфейс, чию адресу IP має бути використано для динамічних оновлень DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "Визначає, наскільки часто слід періодично оновлювати запис DNS клієнта"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 "Максимальне припустиме відхилення періоду при оновленні клієнтського запису "
 "DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 "Визначає, чи слід надавачу даних також явним чином оновлювати запис PTR"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "Визначає, чи слід програмі nsupdate типово використовувати TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 "Визначає тип розпізнавання, який слід використовувати для виконання "
 "оновлення DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 "Перевизначити сервер DNS, який використовуватиметься для виконання оновлення "
 "DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "Керувати нумерацією надійних доменів"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "Частота оновлення списку піддоменів"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "Максимальне відхилення періоду при оновленні списку підлеглих доменів"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "Список параметрів, які має бути успадковано у піддомені"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "Типове значення домашнього каталогу для піддоменів"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 "Строк, протягом якого кешовані реєстраційні дані може бути використано для "
 "розпізнавання за кешем"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 "Визначає, чи слід автоматично створювати приватні групи для користувачів"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 "Показати попередження за вказану кількість днів перед завершенням дії пароля."
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Різноманітні теґи, що зберігаються службою налаштовування realmd для цього "
 "домену."
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
@@ -796,7 +792,7 @@ msgstr ""
 "Засіб надання даних, який має обробляти отримання даних піддоменів. Це "
 "значення має завжди збігатися зі значенням id_provider."
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -805,7 +801,7 @@ msgstr ""
 "оновлення. Іншими словами, параметр визначає тривалість зберігання ключа "
 "вузла у кеші."
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -816,111 +812,111 @@ msgstr ""
 "розпізнавання (довготривалого пароля), який має бути збережено у форматі "
 "контрольної суми SHA512 у кеші."
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr "Правила щодо локальних способів розпізнавання "
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "Домен IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "Адреса сервера IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "Адреса резервного сервера IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "Назва вузла клієнта IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 "Визначає, чи слід автоматично оновлювати запис DNS клієнтського вузла у "
 "FreeIPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "Шукати у базі об’єкти, пов’язані з HBAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 "Інтервал часу між послідовними сеансами пошуку правил HBAC на сервері IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr "Час, у секундах, між пошуками у картах SELinux на сервері IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 "Якщо встановлено значення «false», аргумент вузла, наданий PAM, буде "
 "проігноровано"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "Адреса автоматичного монтування, яку використовує цей клієнт IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "Шукати у базі об’єкт, що містить дані щодо домену IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "Шукати у базі об’єкти, що містять дані щодо діапазонів ідентифікаторів"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "Увімкнути сайти DNS — визначення служб на основі адрес"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "Шукати у базі контейнери перегляду"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "Клас об’єктів для контейнерів перегляду"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "Атрибут із назвою перегляду"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "Клас об’єктів для об’єктів перевизначення"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "Атрибут із посиланням на початковий об’єкт"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "Клас об’єктів для об’єктів перевизначення користувачів"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "Клас об’єктів для об’єктів перевизначення груп"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Шукати у базі пов'язані і профілями станцій об'єкти"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 "Час, у секундах, між пошуками у правилах профілів станцій на сервері IPA"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -928,43 +924,43 @@ msgstr ""
 "Час, у хвилинах, між пошуками у правилах профілів станцій на сервері IPA, "
 "якщо під час останнього запиту не було знайдено жодного правила"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "Основа пошуку для діапазонів SUBID"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 "Правила, які має бути використано для визначення достатності прав доступу"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "Атрибут LDAP, який містить FQDN вузла."
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "Клас об’єктів запису вузла у LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "Використати вказаний рядок як основу пошуку об’єктів вузлів."
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "Атрибут LDAP, який містить відкриті ключі SSH вузла."
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "Атрибут LDAP, який містить назву домену NIS мережевої групи."
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 "Атрибут LDAP, у якому містяться імена учасників мережевої групи (netgroup)."
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
@@ -972,7 +968,7 @@ msgstr ""
 "Атрибут LDAP, у якому міститься список FQDN вузлів і груп вузлів, які є "
 "учасниками мережевої групи."
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
@@ -980,11 +976,11 @@ msgstr ""
 "Атрибут LDAP, у якому міститься список вузлів і груп вузлів, які є "
 "безпосередніми учасниками мережевої групи."
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "Атрибут LDAP, у якому міститься список учасників мережевої групи."
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
@@ -992,20 +988,20 @@ msgstr ""
 "Атрибут LDAP, у якому міститься список загальносистемних користувачів та "
 "груп, які є безпосередніми учасниками мережевої групи."
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "Атрибут LDAP, що відповідає назві мережевої групи (netgroup)."
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "Клас об’єктів запису мережевої групи (netgroup) у LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "Атрибут LDAP, що містить UUID/GUID об’єкта мережевої групи LDAP."
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
@@ -1013,11 +1009,11 @@ msgstr ""
 "Атрибут LDAP, який визначає, чи увімкнено для користування карту "
 "користувачів."
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "Атрибут LDAP, який містить категорію вузла, зокрема «all»."
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
@@ -1025,18 +1021,18 @@ msgstr ""
 "Атрибут LDAP, який містить усі вузли або групи вузлів, для яких "
 "встановлюється відповідність цього правила."
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 "Атрибут LDAP, який містить усі записи користувачів або груп, для яких "
 "встановлюється відповідність цього правила."
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "Атрибут LDAP, що містить назву карти користувачів SELinux."
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -1044,20 +1040,20 @@ msgstr ""
 "Атрибут LDAP, який містить DN правила HBAC, яким можна скористатися для "
 "встановлення відповідності замість memberUser і memberHost."
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "Атрибут LDAP, який містить сам рядок користувача SELinux."
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "Атрибут LDAP, який містить категорію користувача, зокрема «all»."
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 "Атрибут LDAP, який містить унікальний ідентифікатор карти користувачів."
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -1065,51 +1061,51 @@ msgstr ""
 "За допомогою цього параметра можна визначити, чи працює SSSD на сервері IPA "
 "і має виконувати пошуки користувачів і груп з довірених доменів окремо."
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "Використати вказаний рядок як основу пошуку надійних доменів."
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "Домен Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "Увімкнені домени Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "Адреса сервера Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "Адреса резервного сервера Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "Назва клієнтського вузла Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "Фільтр LDAP для визначення прав доступу"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "Чи слід використовувати загальний каталог для пошуку"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "Режим роботи для керування доступом на основі GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 "Інтервал часу між послідовними сеансами пошуку правил GPO на сервері AD"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
@@ -1117,7 +1113,7 @@ msgstr ""
 "Назви служб PAM, які виконують прив’язування до параметрів правил GPO "
 "(Deny)InteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
@@ -1125,299 +1121,299 @@ msgstr ""
 "Назви служб PAM, які виконують прив’язування до параметрів правил GPO "
 "(Deny)RemoteInteractiveLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 "Назви служб PAM, які виконують прив’язування до параметрів правил GPO "
 "(Deny)NetworkLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 "Назви служб PAM, які виконують прив’язування до параметрів правил GPO "
 "(Deny)BatchLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 "Назви служб PAM, які виконують прив’язування до параметрів правил GPO "
 "(Deny)ServiceLogonRight"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "Назви служб PAM, яким завжди надається доступ на основі GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "Назви служб PAM, яким ніколи не надається доступ на основі GPO"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 "Типове правило входу (або допуск/заборона), яким слід користуватися для "
 "неприв’язаних назв служб PAM"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "певний сайт, який слід використовувати клієнту"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 "Максимальний вік пароля облікового запису комп'ютера, при досягненні якого "
 "пароль має бути оновлено"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 "Параметр налаштовування завдання оновлення облікових записів комп’ютерів"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 "Визначає, чи слід оновлювати пароль облікового запису комп'ютера у базі "
 "даних Samba"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "Використовувати порт LDAPS для запитів LDAP і загального каталогу (GC)"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "Не фільтрувати локальні групи домену з інших доменів"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Адреса сервера Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Адреса резервного сервера Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Область Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "Час очікування на розпізнавання"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "Визначає, чи слід створювати файли kdcinfo"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "Місце, куди слід скидати фрагменти налаштувань krb5"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "Каталог, де зберігатиметься кеш реєстраційних даних"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "Адреса кешу реєстраційних даних користувача"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "Адреса таблиці ключів для перевірки реєстраційних даних"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "Увімкнути перевірку реєстраційних даних"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "Зберігати пароль у автономному режимі для розпізнавання у мережі"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "Поновлюваний строк дії TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "Строк дії TGT"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "Граничний час між двома перевірками для поновлення"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "Вмикає FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "Визначає реєстраційний запис, який слід використовувати для FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "Анонімні PKINIT для запитів щодо реєстраційних даних FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "Вмикає перетворення реєстраційних записів у канонічну форму"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "Увімкнути промислові реєстраційні дані"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "Вмикає використання областей піддоменів для розпізнавання"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "Прив’язка імен користувачів до основних імен Kerberos"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 "Сервер, на якому запущено службу зміни паролів, якщо такий не вдасться "
 "виявити у KDC"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri, адреса URI сервера LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri, адреса сервера LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "Типова базова назва домену"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "Тип схеми, використаний на сервері LDAP, rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "Режим для зміни пароля користувача"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "Типова назва домену прив’язки"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "Тип розпізнавання для типової назви сервера прив’язки"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "Лексема розпізнавання типової назви сервера прив’язки"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "Проміжок часу між спробами встановлення з’єднання"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "Проміжок часу між спробами виконання синхронних операцій LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 "Проміжок часу між повторними спробами встановлення з’єднання у автономному "
 "режимі"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "Використовувати для назв областей лише великі літери"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "Файл, що містить сертифікати CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "Шлях до каталогу сертифікатів CA"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "Файл, що містить клієнтський сертифікат"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "Файл, що містить клієнтський ключ"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "Показати список можливих інструментів шифрування"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "Потрібна перевірка сертифіката TLS"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "Вкажіть механізм SASL, який слід використовувати"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "Вкажіть ідентифікатор уповноваження SASL, який слід використовувати"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "Вкажіть область уповноваження SASL, яку слід використовувати"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 "Вказати мінімальне значення SSF для розпізнавання на LDAP за допомогою sasl"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 "Вказати максимальне значення SSF для розпізнавання на LDAP за допомогою sasl"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Таблиця ключів служби Kerberos"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "Розпізнавання Kerberos для з’єднання LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "Переходити за посиланнями LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "Строк дії TGT для з’єднання LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "Спосіб розіменування псевдонімів"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "Назва служби для пошуків за допомогою служби DNS"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "Кількість записів, які слід отримувати у відповідь на один запит LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 "Кількість учасників, яких має не вистачати для вмикання повного скасування "
 "посилань"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "Ігнорувати непридатні до читання посилання LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
@@ -1425,7 +1421,7 @@ msgstr ""
 "Визначає, чи має бібліотека LDAP виконувати зворотній пошук з метою "
 "переведення назв вузлів у канонічну форму під час прив’язки до SASL"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -1433,30 +1429,36 @@ msgstr ""
 "Надає змогу зберігати локальних користувачів як учасників групи LDAP для "
 "серверів, у яких використовується схема RFC2307."
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "Атрибут entryUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "Атрибут lastUSN"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "Тривалість підтримування з’єднання з сервером LDAP перед роз’єднанням"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "Вимкнути контроль сторінок у LDAP"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "Вимкнути отримання діапазонів Active Directory"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr "Використати розширення ppolicy"
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "Тривалість очікування на дані запиту пошуку"
@@ -2075,34 +2077,34 @@ msgstr "Шлях до початкового тексту файла passwd."
 msgid "Path of group file sources."
 msgstr "Шлях до початкового тексту файла group."
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr "Помилка дії з налаштуваннями\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr "'"
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 "Непідтримуване значення «%s» параметра налаштувань «%s»! Передбачено "
 "підтримку лише 'root' і '"
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "Запуститися фонову службу (типова поведінка)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "Запустити у інтерактивному режимі (без фонової служби)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "Вивести номер версії і завершити роботу"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -2113,101 +2115,101 @@ msgstr ""
 "Некоректний параметр %s: %s\n"
 "\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 "Параметр -i|--interactive не можна поєднувати із параметром -D|--daemon\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr "Не вдалося отримати початкові можливості\n"
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 "Підтримку служб користувача поза root не зібрано. Неможливий запуск від %"
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr "Не вдалося прочитати налаштування: '%s'\n"
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr "Не вдалося виконати початкове завантаження процесу «monitor» SSSD: %s"
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "Не вистачає пам'яті\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "Дозволити дампи ядра"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "Дескриптор відкритого файла для запису журналів діагностики"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "Користувач, від імені якого слід створити ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "Група, від імені якої слід створити ccache FAST"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "Анонімний PKINIT для запитів щодо квитка захисту FAST"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "Область Kerberos, якою слід скористатися"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "Запитаний строк дії квитка"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "Запитаний час оновлення строку дії квитка"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "Параметри FAST ('never', 'try', 'demand')"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 "Визначає реєстраційний запис сервера, який слід використовувати для FAST"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "Вимагає перетворення реєстраційного запису у канонічну форму"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "Використовувати нетипову версію krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 "Ідентифікатор ланцюжка Tevent, який використовується для ведення журналу"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "Перевірити прапорці PAC"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "Помилка talloc_asprintf.\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "Помилка set_debug_file_from_fd.\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "Домен надання відомостей (обов’язковий)"
 
@@ -2239,16 +2241,16 @@ msgstr "Сталася помилка, але не вдалося знайти 
 msgid "Unexpected error while looking for an error description"
 msgstr "Неочікувана помилка під час пошуку опису помилки"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "Відмовлено у доступі. "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "Повідомлення сервера: "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
@@ -2256,50 +2258,50 @@ msgstr ""
 "Після входу до системи не буде надано TGT Kerberos. Це може завадити "
 "нормальній роботі користувача."
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "Введіть PIN:"
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "Паролі не збігаються"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "Підтримки скидання пароля користувачем root не передбачено."
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "Розпізнано за реєстраційними даними з кешу"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr ", строк дії вашого кешованого пароля завершиться: "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "Строк дії вашого пароля вичерпано. Залишилося %1$d резервних входи."
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "Строк дії вашого пароля завершиться за %1$d %2$s."
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "Строк дії вашого пароля вичерпано."
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "Розпізнавання заборонено до: "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "Система працює у автономному режимі, зміна пароля неможлива"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
@@ -2307,11 +2309,11 @@ msgstr ""
 "Після зміни пароля OTP вам слід вийти із системи і увійти до неї знову, щоб "
 "отримати про квиток"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN заблоковано"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
@@ -2319,67 +2321,67 @@ msgstr ""
 "Не надано TGT Kerberos, оскільки на сервері не передбачено підтримки цього "
 "методу. Це завадить використанню single-sign on(SSO)."
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "Спроба зміни пароля зазнала невдачі. "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "Пройдіть розпізнавання на %1$s і натисніть ENTER."
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 "Пройдіть розпізнавання за допомогою PIN %1$s на %2$s і натисніть ENTER."
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "Будь ласка, вставте (повторно) (іншу) смарт-картку"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "Новий пароль: "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "Ще раз введіть новий пароль: "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "Перший фактор: "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "Другий фактор (необов'язковий): "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "Другий фактор: "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "Вставте ваш пристрій ключа і натисніть клавішу ENTER."
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "Пароль: "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "Перший фактор (поточний пароль): "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "Поточний пароль: "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "Строк дії пароля вичерпано. Змініть ваш пароль."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "Рівень діагностики під час запуску"
 
@@ -2388,7 +2390,7 @@ msgstr "Рівень діагностики під час запуску"
 msgid "The SSSD domain to use"
 msgstr "Домен SSSD, який слід використовувати"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "Помилка під час спроби встановити локаль\n"
 
@@ -2415,12 +2417,10 @@ msgid ""
 "\n"
 msgstr ""
 "\n"
-"*****************************************************************************"
-"*\n"
+"******************************************************************************\n"
 "У вашій системі використано застарілу програму sss_ssh_knownhostsproxy.\n"
 "Ознайомтеся із довідкою до sss_ssh_knownhosts(1), щоб її замінити.\n"
-"*****************************************************************************"
-"*\n"
+"******************************************************************************\n"
 "\n"
 
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:207
@@ -2458,85 +2458,89 @@ msgstr "sss_ssh_knownhostsproxy: з'єднання із вузлом %s, пор
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy: не вдалося визначити назву вузла %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "Вказаному критерію пошуку не відповідає жоден об’єкт у кеші\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "Не вдалося скасувати чинність %1$s\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "Не вдалося скасувати чинність %1$s %2$s\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "Скасувати чинність усіх кешованих записів"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "Скасувати визначення певного користувача"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "Скасувати визначення всіх користувачів"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "Скасувати визначення певної групи"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "Скасувати визначення всіх груп"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "Скасувати визначення певної мережевої групи"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "Скасувати визначення всіх мережевих груп"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "Скасувати визначення певної служби"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "Скасувати визначення всіх служб"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "Скасувати визначення певну карту autofs"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "Скасувати визначення всіх карт autofs"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "Скасувати чинність певного вузла SSH"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "Скасувати чинність усіх вузлів SSH"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "Скасувати чинність певного правила sudo"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "Скасувати чинність усіх кешованих правил sudo"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "Скасувати визначення лише записів з певного домену"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
@@ -2544,12 +2548,12 @@ msgstr ""
 "Надано неочікувані аргументи. Параметри, які скасовують чинність окремого "
 "об'єкта вимагають лише одного наданого аргументу.\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 "Будь ласка, виберіть принаймні один об’єкт для скасовування відповідності\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2558,7 +2562,7 @@ msgstr ""
 "Не вдалося відкрити домен %1$s. Якщо цей домен є піддоменом (довіреним "
 "доменом), скористайтеся повною назвою замість параметра --domain/-d.\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "Не вдалося відкрити доступні домени\n"
 
@@ -2592,161 +2596,161 @@ msgstr "Не вдалося прочитати вхідні дані корис
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "Некоректні вхідні дані, будь ласка, вкажіть «%s» або «%s».\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "Помилка під час спроби виконати зовнішню команду\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "Помилка під час спроби виконати зовнішню команду «%s»\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "Не вдалося виконати команду «%s», код [%d]\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "SSSD має бути запущено. Запустити SSSD зараз?"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "Роботу SSSD не завершено. Зупинити SSSD зараз?"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "SSSD слід перезапустити. Перезапустити SSSD зараз?"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "Стан SSSD:"
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "Вивести список доступних доменів"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "Вивести відомості щодо домену"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "Вивести відомості щодо користувача і перевірити розпізнавання"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "Створити звіт щодо доступу до домену"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "Відомості щодо кешованих даних:"
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "Відомості щодо кешованого користувача"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "Відомості щодо кешованої групи"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "Відомості щодо кешованої мережевої групи"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "Локальні інструменти даних:"
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "Створити резервну копію локальних даних"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "Відновити локальні дані з резервної копії"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "Створити резервну копію локальних даних і вилучити кешовані дані"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "Скасувати чинність усіх кешованих об'єктів"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "Керувати покажчиками кешу"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "Інструменти файлів журналу:"
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "Вилучити наявні файли журналу SSSD"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "Архівувати файли журналу SSSD до архіву tar"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "Змінити або вивести дані щодо рівня діагностики SSSD"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "Аналізувати записані до журналу дані"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "Інструменти файлів налаштувань:"
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "Виконати статичний аналіз налаштувань SSSD"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "Пов'язані із сертифікацією інструменти:"
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "Вивести відомості щодо сертифіката"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "Показати користувачів, яких пов'язано із сертифікатом"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "Перевірити прив'язку та правило відповідності за допомогою сертифіката"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr "Пов'язані із GPO інструменти:"
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 msgid "Information about cached GPO"
 msgstr "Відомості щодо кешованого GPO"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr "Нумерувати кешовані GPO"
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr "Вилучити кешований GPO"
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr "Вилучити усі кешовані GPO"
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "Пов'язані із ключем інструменти:"
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "Виконати реєстрацію ключа"
 
@@ -2800,7 +2804,7 @@ msgstr "Версія правил"
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "Помилка: не вдалося отримати об'єкт [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: не вдалося прочитати значення [%d]: %s\n"
@@ -2814,99 +2818,99 @@ msgstr "Вказати ім'я."
 msgid "Unable to parse name %s.\n"
 msgstr "Не вдалося обробити ім'я %s.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "Шукати за SID"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "Шукати за ідентифікатором користувача"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Час завершення строку дії груп ініціалізації"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "Шукати за ідентифікатором групи"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr "Шукати за GUID GPO"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "Не вдалося обробити рядок команди: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr "%s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr "Не вдалося надрукувати об'єкт: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr "Помилка talloc\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr "Не вдалося отримати список атрибутів!\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr "Не вдалося створити фільтр\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr "%s [%s]:\n"
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr "Не вдлаося отримати базову DN GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "Не вдалося виконати пошук у sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "Не вдалося перетворити повідомлення на атрибути sysdb: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr "\t%s: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr "Не вдалося знайти атрибут GUID за записом GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr "Не вдалося знайти атрибут опису за записом GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr "Не вдалося вилучити запис GPO з кешу\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
@@ -2915,115 +2919,115 @@ msgstr ""
 "Шлях GPO ще не зберігається у кеші. Будь ласка, вилучіть файли з [%s] "
 "вручну\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr "Не вдалося визначити справжній шлях для [%s]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr "Кешований шлях GPO [%s] не перебуває у [%s], ігноруємо.\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "Не вдалося вилучити отримані файли GPO: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "Не вдалося отримати запис кешу: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr "Не вдалося визначити домен об'єкта\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr "Не вдалося знайти атрибут GUID у записі GPO\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "Не вдалося вилучити GPO: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr "%s вилучено з кешу\n"
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "Показати діагностичні відомості"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "Вказати закодований у base64 сертифікат."
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 "Не вдалося встановити з'єднання із системним каналом передавання даних!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - не знайдено пов'язаних користувачів -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "Правило прив'язки"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "Правило відповідності"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "Не вдалося обробити аргументи команди\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "Не вистачає пам'яті\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "Не вдалося встановити контекст прив'язки сертифікатів.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 "Не вдалося додати прив'язку і правила відповідності. Помилка: [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "Не вдалося декодувати рядок base64.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "Сертифікат відповідає правилу.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "Сертифікат не відповідає правилу.\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 "Помилка під час спроби встановити відповідність сертифіката [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "Не вдалося створити фільтр прив'язки [%d][%s].\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -3036,7 +3040,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -3047,35 +3051,35 @@ msgstr ""
 "файлом налаштувань є «/my/path/sssd.conf», буде використано каталог "
 "фрагментів «/my/path/conf.d»)"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "Файла %1$s не існує.\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "Немає налаштувань.\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "Не вдалося прочитати «%s»: %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "Не вдалося запустити засоби перевірки"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "Вади, які виявлено засобами перевірки: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "Повідомлення, створені під час об'єднування налаштувань: %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "Використаних файлів фрагментів налаштувань: %zu\n"
@@ -3098,102 +3102,102 @@ msgstr "Не вдалося експортувати перевизначенн
 msgid "Unable to export group overrides\n"
 msgstr "Не вдалося експортувати перевизначення групи\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "Перевизначити наявну резервну копію"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "Не вдалося імпортувати перевизначення користувача\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "Не вдалося імпортувати перевизначення групи\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "Запустити SSSD, якщо його ще не запущено"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "Перезапустити SSSD після імпортування даних"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "Створити порожні файли кешу і імпортувати локальні дані"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "Зупинка SSSD до вилучення кешу"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "Запуск SSSD після вилучення кешу"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "Створюємо резервну копію локальних даних...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 "Не вдалося створити резервну копію локальних даних, не вдалося вилучити "
 "кеш.\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "Вилучаємо файли кешу...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "Не вдалося вилучити файли кешу\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "Відновлюємо локальні дані...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "Створюємо покажчик кешу для домену %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "Вилучаємо покажчик кешу для домену %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "Покажчики для домену %1$s:\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  Атрибут: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "Спрямувати на вказаний домен"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "домен"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "Атрибут для індексування"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "атрибут"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "Дію не надано\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -3202,181 +3206,181 @@ msgstr ""
 "Невідома дія: %1$s\n"
 "Коректними діями є такі: «%2$s», «%3$s» та «%4$s»\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "Атрибут (-a) не задано\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "Атрибут %1$s не індексовано.\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "Атрибут %1$s вже індексовано.\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "Помилка дії з покажчиком: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "Не забудьте також оновити покажчики на віддалених надавачах даних.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 "Показати список доменів з включенням основних або довірених типів доменів"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "У мережі"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "Поза мережею"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "Стан з'єднання: %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "У цьому домені немає активних серверів.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "Активні сервери:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "не з’єднано"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "Не виявлено жодного сервера.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "Виявлено сервери %s:\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "Поки немає.\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "Показати стан з'єднання"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "Показати дані щодо активного сервера"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "Показати список виявлених серверів"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "Вказати назву домену."
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "Не вдалося отримати стан з'єднання\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "Не вдалося отримати список серверів\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD не запущено.\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s Невідомий домен\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s Недоступна служба\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "Вилучити файли журналу замість обрізання"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "Вилучаємо файли журналу...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "Не вдалося вилучити файли журналу\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "Обрізаємо файли журналу...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "Не вдалося обрізати файли журналу\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "Архівуємо файли журналу до %s...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "Не вдалося архівувати файли журналу\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "Ціль — пристрій SSSD"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "Ціль — служба NSS"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "Ціль — служба PAM"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "Ціль — служба SUDO"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "Ціль — служба AUTOFS"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "Ціль — служба SSH"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "Ціль — служба PAC"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "Ціль — служба IFP"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "Вкажіть рівень діагностики, яким ви хочете скористатися"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 "Помилка: немає підтримки ідентифікатора ланцюжка Tevent, можливість аналізу "
@@ -3443,19 +3447,19 @@ msgstr ""
 " - оболонка: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "Дія PAM [auth|acct|setc|chau|open|clos], типове значення: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "Служба PAM, типове значення: "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "Вказати ім'я користувача."
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3468,22 +3472,22 @@ msgstr ""
 "служба: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "Не вдалося знайти користувача за допомогою [%s].\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "Не вдалося знайти користувача InfoPipe за допомогою [%s].\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "Помилка pam_start: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3491,12 +3495,12 @@ msgstr ""
 "перевіряємо pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "Помилка pam_get_item: %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3505,7 +3509,7 @@ msgstr ""
 "pam_authenticate для користувача [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3513,7 +3517,7 @@ msgstr ""
 "перевіряємо pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3522,7 +3526,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3530,7 +3534,7 @@ msgstr ""
 "перевіряємо pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3539,7 +3543,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3547,7 +3551,7 @@ msgstr ""
 "перевіряємо pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3556,7 +3560,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3564,7 +3568,7 @@ msgstr ""
 "перевіряємо pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3573,7 +3577,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3581,7 +3585,7 @@ msgstr ""
 "перевіряємо pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3590,26 +3594,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "невідома дія\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "Середовище PAM:\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " - немає середовища -\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "Вказати нетиповий файл налаштувань"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "Інформує про те, що на відповідачі задіяно сокет"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "Кількість повторних спроб встановлення з’єднання з надавачами даних"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "Вимкнути інтерфейс netlink"
 
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 72411381952..c70387317be 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2023-07-24 17:21+0000\n"
 "Last-Translator: Funda Wang <fundawang@yeah.net>\n"
 "Language-Team: Chinese (Simplified) <https://translate.fedoraproject.org/"
@@ -52,26 +52,22 @@ msgid "Command to start service"
 msgstr "启动服务命令"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr "试图连接到 Data Providers 的次数"
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr "可能会被该响应者打开的文件描述符的数量"
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr "客户端自动断开连接之前的空闲时间"
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr "自动关闭响应者之前的空闲时间"
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr "在查询 Data Providers 之前，始终查询所有缓存"
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -81,57 +77,57 @@ msgstr ""
 "当 SSSD 切换到脱机模式时，它尝试重新上线前的时间会根据断开连接的时间而增加。"
 "这个值以秒为单位，并使用以下公式计算：offline_timeout + random_offset。"
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "SSSD 服务启动"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "SSSD 域启动"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "正则表达式解析用户名和域"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr "兼容 Printf 的格式用于显示完全限定名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr "SSSD 应该在其中存储 Kerberos 重放缓存文件的文件系统上的目录。"
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr "要添加到名称中的域，没有域组件。"
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr "放弃特权的用户"
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr "调整证书验证"
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr "组或用户名中的所有空格都将替换为该字符"
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr "调整 sssd 来接受或忽略 netlink 状态更改"
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr "启用或禁用隐式文件域"
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr "要查询的域的特定顺序"
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -139,7 +135,7 @@ msgstr ""
 "控制 SSSD 是否应监控 resolv.conf 的状态，以确定何时需要更新其内部 DNS 解析"
 "器。"
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -150,88 +146,88 @@ msgstr ""
 "下，我们会尝试使用 inotify 进行。如果不能使用 inotify，则会回到每五秒轮询一"
 "次 resolv.conf 的状态。"
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr "为 AD 和 IPA 提供商自动运行 PAC 响应器"
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr "为所有 SSSD 进程启用或禁用内核转储。"
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr "调整密码验证行为"
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr "枚举缓存超时时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr "条目缓存后台更新超时时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr "负缓存超时时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr "文件负缓存超时时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "SSSD 应该明确忽略的用户"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "SSSD 应该明确忽略的组"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "出现在组中的应将过滤的用户"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr "NSS 提供程序应返回的密码字段的值"
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr "使用此值覆盖来自身份提供者的 homedir 值"
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr "使用此值替换来自身份提供者的空的 homedir 值"
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr "使用此值覆盖来自身份提供者的 shell 值"
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr "允许进行登陆的 shell 用户列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr "将被否决并替换为后备 shell 的 shell 列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr "如果允许使用存储在中央目录中的 shell 但并不存在，使用这个后备"
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr "如果提供程序未列出，则使用这个 shell"
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr "内存缓存记录有效期的长度"
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
@@ -239,14 +235,14 @@ msgstr ""
 "为 passwd 请求在快速内存缓存（in-memory cache）中分配的数据表的大小（以 MB 为"
 "单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 "为组请求在快速内存缓存（in-memory cache）中分配的数据表的大小（以 MB 为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
@@ -254,7 +250,7 @@ msgstr ""
 "为 initgroups 请求在快速内存缓存（in-memory cache）中分配的数据表的大小（以 "
 "MB 为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
@@ -262,13 +258,13 @@ msgstr ""
 "如果模板中包含格式字符串%H，那么这个选项的值将被用于 override_homedir 选项的"
 "扩展。"
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr "指定子域列表被视为有效的时间，以秒为单位。"
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -277,99 +273,99 @@ msgstr ""
 "条目缓存可以设置为在后台自动更新条目，如果被请求的时间超过域名的 "
 "entry_cache_timeout 值的一个百分比。"
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr "在线登录间隔多长时间内允许使用缓存的登录（以天为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr "离线时允许多少次失败的登录尝试"
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 "当达到 offline_failed_login_attempts 之后多长时间要拒绝登录（以分钟为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr "在身份验证期间向用户显示什么信息"
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr "过滤发送到 pam_sss 的 PAM 响应"
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr "为 PAM 请求保留多长时间的身份信息缓存（以秒为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr "在密码过期前几天应显示警告信息"
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr "受信任的 uid 或用户名列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr "即使不受信任的用户也可以访问的域列表。"
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr "当用户账户过期时显示的消息。"
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr "当用户账户被锁住时显示的消息。"
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr "允许基于证书/智能卡的身份验证。"
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr "带有 PKCS＃11 模块的证书数据库的路径。"
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 msgid "Tune certificate verification for PAM authentication."
 msgstr "对 PAM 验证调整证书验证。"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr "pam_sss 等待 p11_child 完成的时间（以秒为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr "允许哪些 PAM 服务联系应用程序域"
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr "允许服务使用智能卡"
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr "等待卡的额外超时，如果请求"
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr "PKCS#11 URI，用于限制智能卡认证设备的选择"
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr "什么时候 PAM 响应者要强制发起 initgroups 请求"
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr "允许使用 GSSAPI 验证的 PAM 服务列表。"
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr "是否与目标用户匹配认证的 UPN"
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
@@ -377,74 +373,74 @@ msgstr ""
 "<PAM service>:<authentication indicator> 对列表，它们必须强制使用 GSSAPI 身份"
 "验证进行 PAM 访问"
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr "允许使用通行密钥设备认证。"
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr "pam_sss 等待 passkey_child 完成的时间"
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr "在 libfido2 库中启用调试功能"
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr "是否在 sudo 规则中评估基于时间的属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr "如果为 true，SSSD 将切换回 lower-wins ordering 逻辑"
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr "一次可以刷新的最大规则数。如果超出此范围，则执行完全刷新。"
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr "在 known_hosts 文件中是否对主机名和地址进行哈希处理"
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 "当请求了它的主机密钥后，将主机保留在 known_hosts 文件中的时间（以秒为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr "到可信 CA 证书存储的路径"
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr "允许从证书中生成 ssh-keys"
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr "使用以下匹配规则来过滤生成 ssh-key 的证书"
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr "允许访问 PAC 响应者的 UID 或用户名列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr "PAC 数据被视为有效的时间长度"
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr "验证 PAC"
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr "允许 InfoPipe 发布的用户属性列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
@@ -453,7 +449,7 @@ msgstr ""
 "使用以下字符串之一指定会话记录范围： none - 不记录用户。 some - 记录由用户和"
 "组选项指定的用户和组。 all - 记录所有用户。"
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -462,7 +458,7 @@ msgstr ""
 "以逗号分隔的用户列表，这些用户应该启用会话记录。匹配 NSS 返回的用户名。在可能"
 "的空格替换、大小写更改等之后。"
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -471,239 +467,239 @@ msgstr ""
 "以逗号分隔的组列表，其成员应已启用会话记录。匹配NSS 返回的组名。在可能的空格"
 "替换、大小写改变等之后。"
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr "要从记录中排除的用逗号分开的用户列表，仅当 scope=all 时"
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr "用逗号分隔的组列表，其中的成员应不记录中排除，仅在 scope=all 时。 "
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "身份提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "身份验证提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "访问控制提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "密码改变提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr "SUDO 提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr "Autofs 提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr "主机身份提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr "SELinux 提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr "会话管理提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr "解析器提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr "域是否可以被 OS 或应用程序使用"
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 msgid "Enable or disable the domain"
 msgstr "启用或禁用域"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "最小用户 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "最大用户 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "启用枚举所有用户/组"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "为脱机登录缓存凭据"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr "以完全限定的形式显示用户/组"
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr "在组查询中不包括的组成员"
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr "输入缓存超时时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr "执行 DNS 查找时限制或首选使用特定的地址系列"
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr "上次成功登录后保留缓存条目的时间（天）"
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr "在尝试下一个服务器之前，SSSD 应该与一个 DNS 服务器联系多久（毫秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr "尝试解析单个 DNS 查询需要多长时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr "解析服务器时等待 DNS 回复的时间（秒）"
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr "服务发现 DNS 查询的域部分"
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr "使用此值覆盖来自身份提供者的 GID 值"
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr "用户名区分大小写"
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr "过期条目应在后台刷新的频率"
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr "在后台刷新过期条目时的最大周期偏差"
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr "是否自动更新客户端的 DNS 条目"
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr "更新后应用于客户端 DNS 条目的TTL"
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr "应该用于动态 DNS 更新的接口的 IP 地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr "定期更新客户端的 DNS 条目的频率"
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr "更新客户端的 DNS 条目时的最大周期偏差"
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr "提供者是否应该明确更新 PTR 记录"
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr "nsupdate 实用程序是否应默认使用 TCP"
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr "在执行 DNS 更新时应该使用哪种身份验证"
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr "覆盖用于执行 DNS 更新的 DNS 服务器"
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr "信任域的控制枚举"
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr "子域列表应该多久刷新一次"
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr "刷新子域列表时的最大周期偏差"
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr "应该被继承到子域中的选项列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr "默认子域 homedir 值"
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr "可以使用缓存凭证用于缓存身份验证的时间"
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr "是否自动为用户创建私人组"
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr "在密码过期前 N 天显示一个警告。"
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr "realmd 配置服务为这个域存储的各种标签。"
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr "应该处理子域获取的提供者，这个值应始终和 id_provider 相同。"
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr "刷新后主机 ssh 密钥要保留多少秒。IE 缓存主机密钥多长时间。"
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -712,105 +708,105 @@ msgstr ""
 "如果使用 2-Factor-Authentication (2FA)，应该保存凭证，这个值决定了第一个认证"
 "因素(（期密码）必须以SHA512 哈希值的形式保存到缓存中的最小长度。"
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA 域"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA 服务器地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr "IPA 备份服务器地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA 客户端主机名"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr "是否在 FreeIPA 中自动更新客户端的 DNS 条目"
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr "HBAC 相关对象的搜索基础"
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr "针对 IPA 服务器查找 HBAC 规则之间的时间间隔"
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr "针对 IPA 服务器查找 SELinux 映射之间的时间间隔"
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr "如果设置为 false，PAM 提供的主机参数将被忽略"
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr "此 IPA 客户端使用的自动挂载器的位置"
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr "搜索包含有关 IPA 域信息的对象的搜索基础"
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr "搜索包含有关 ID 范围信息的对象的搜索基础"
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr "启用 DNS 站点 - 基于位置的服务发现"
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr "查看容器的搜索基础"
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr "查看容器的对象类"
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr "具有视图名称的属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr "覆盖对象的对象类"
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr "带有到原始对象参考的属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr "用户覆盖对象的对象类"
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr "组覆盖对象的对象类"
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr "Desktop Profile 相关对象的搜索基础"
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr "针对 IPA 服务器查找 Desktop Profile 规则之间的时间间隔"
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
@@ -818,101 +814,101 @@ msgstr ""
 "当最后一个请求未找到任何规则时，针对 IPA 服务器的Desktop Profiles 规则查找之"
 "间的时间间隔（以分钟为单位）"
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr "搜索 SUBID 范围的基础"
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr "应该使用哪些规则来评估访问控制"
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr "包含主机 FQDN 的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr "LDAP 中主机条目的对象类。"
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr "使用给定的字符串作为主机对象的搜索基础。"
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr "包含主机 SSH 公钥的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr "包含 netgroup 的 NIS 域名的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr "包含 netgroup 成员名称的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr "列出属于 netgroup 成员的主机和主机组的 FQDN 的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr "LDAP属性，列出作为 netgroup 直接成员的主机和主机组。"
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr "列出 netgroup 成员资格的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr "LDAP 属性，列出作为 netgroup 直接成员的系统用户和组。"
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr "与 netgroup 名称相对应的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr "LDAP 中 netgroup 条目的对象类。"
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr "包含 LDAP netgroup 对象的 UUID/GUID 的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr "包含是否启用用户映射的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr "包含主机类别的 LDAP 属性，如'all'。"
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr "包含此规则所匹配的所有主机/主机组的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr "包含该规则所匹配的所有用户/组的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr "包含 SELinux usermap 名称的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
@@ -920,19 +916,19 @@ msgstr ""
 "包含 HBAC 规则的 DN 的 LDAP 属性，可以用来代替 memberUser 和 memberHost 进行"
 "匹配。"
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr "包含 SELinux 用户字符串的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr "包含用户类别的 LDAP 属性，如'all'。"
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr "包含用户映射的唯一 ID 的 LDAP 属性。"
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
@@ -940,368 +936,374 @@ msgstr ""
 "该选项表示 SSSD 在 IPA 服务器上运行，应该以不同的方式执行来自受信任域的用户和"
 "组的查找。"
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr "使用给定的字符串作为可信域的搜索基础。"
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr "活动目录域"
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr "启用活动目录域"
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr "没动目录服务器地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr "没动目录备份服务器地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr "活动目录客户端主机名"
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr "用于决定访问权限 的 LDAP 过滤器"
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr "是否使用 Global Catalog 进行查找"
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr "基于 GPO 的访问控制的操作模式"
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr "针对 IPA 服务器查找 GPO 策略文件之间的时间间隔"
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr "映射到 GPO (Deny)InteractiveLogonRight 策略设置的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr "映射到 GPO (Deny)RemoteInteractiveLogonRight 策略设置的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr "映射到 GPO (Deny)NetworkLogonRight 策略设置的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr "映射到 GPO (Deny)BatchLogonRight 策略设置的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr "映射到 GPO (Deny)ServiceLogonRight 策略设置的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr "基于 GPO 的访问始终会被授予的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr "基于 GPO 的访问始终会被拒绝的 PAM 服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr "用于未映射的 PAM 服务名称的默认登录权（或允许/拒绝）"
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr "客户要使用的特定站点"
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr "机器账户密码需要续订的最长期限（天）"
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr "用于调整机器账户续订任务的选项"
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr "是否要更新 Samba 数据库中的机器账户密码"
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr "将 LDAPS 端口用于 LDAP 和 Global Catalog 请求"
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr "不要从其它域过滤域本地组"
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos 服务器地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr "Kerberos 备份服务器地址"
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr "Kerberos 域"
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "验证超时"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr "是否创建 kdcinfo 文件"
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr "在哪里放置 krb5 配置片段"
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "存储凭证缓存的目录"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "用户凭证缓存的位置"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "用于验证凭据的密钥表的位置"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "启用凭证验证"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr "离线时存储密码，以便以后进行在线身份验证"
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr "TGT 的可更新寿命"
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr "TGT 的寿命"
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr "两次更新检查之间的间隔时间"
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr "启用 FAST"
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr "选择用于 FAST 的主体"
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr "使用匿名 PKINIT 请求 FAST 凭证"
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr "启用主体规范化"
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr "启用企业主体"
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr "允许使用子域域进行身份验证"
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr "从用户名到 Kerberos 主体名称的映射"
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr "如果不在 KDC 上，运行更改密码服务的服务器"
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr "ldap_uri，LDAP 服务器的 URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr "ldap_backup_uri，LDAP 服务器的 URI"
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr "默认基本 DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr "LDAP 服务器上使用的 Schema Type，rfc2307"
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr "用来修改用户密码的模式"
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr "默认绑定 DN"
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr "默认绑定 DN 的身份验证令牌的类型"
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr "默认绑定 DN 的身份验证令牌"
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr "尝试连接的时间长度"
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr "尝试同步 LDAP 操作的时间长度"
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr "离线时尝试重新连接的时间间隔"
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr "对于域名称仅使用大写字母"
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr "包含 CA 证书的文件"
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr "CA 证书目录的路径"
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr "包含客户端 CA 证书的文件"
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr "包含客户端密钥的文件"
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr "可能的加密套件列表"
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "调整 TLS 证书验证"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "指定要使用的 sasl 机制"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "指定要使用的 sasl 授权 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr "指定要使用的 sasl 授权域"
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr "为 LDAP sasl 授权指定最小的 SSF"
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr "为 LDAP sasl 授权指定最大的 SSF"
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr "Kerberos服务密钥表"
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr "使用 Kerberos 身份验证进行 LDAP 连接"
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr "遵循 LDAP 引用"
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr "TGT 的 LDAP 连接生命周期"
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr "如何取消引用别名"
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr "DNS 服务查找的服务名称"
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr "单个 LDAP 查询中要检索的记录数"
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr "触发完全取消引用请最少需要缺少的成员数"
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr "忽略不可读的 LDAP 引用"
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr "在 SASL绑定期间，LDAP 库是否应执行反向查找以规范化主机名"
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr "允许保留本地用户作为使用 RFC2307 模式的服务器的 LDAP 组成员。"
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr "entryUSN 属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr "lastUSN 属性"
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr "断开连接前与 LDAP 服务器保持连接的时间"
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr "禁用 LDAP 分页控制"
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr "禁用 Active Directory 范围检索"
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "等待搜索请求的时间长度"
@@ -1888,33 +1890,33 @@ msgstr "passwd 文件源的路径。"
 msgid "Path of group file sources."
 msgstr "group 文件源的路径。"
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 #, fuzzy
 msgid "Config operation failed\n"
 msgstr "索引操作失败：%1$s\n"
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "成为守护进程（默认）"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "交互式运行（不是守护程序）"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr "显示版本号并退出"
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, fuzzy, c-format
 msgid ""
 "\n"
@@ -1922,97 +1924,97 @@ msgid ""
 "\n"
 msgstr "索引操作失败：%1$s\n"
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr "选项 -i|--interactive 不能和 -D|--daemon 一起使用\n"
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "无可用内存\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr "允许内核转储"
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr "调试日志的打开文件描述符"
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr "用户创建 FAST 缓存为"
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr "组创建 FAST 缓存为"
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr "使用匿名 PKINIT 请求 FAST armor 票"
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr "要使用的 kerberos 域"
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr "要求的票证寿命"
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr "要求的可续约票证寿命"
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr "FAST 选项（'never'、'try'、'demand'）"
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr "指定用于 FAST 的服务器主体"
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr "要求规范化主体名称"
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr "使用自定义版本的 krb5_get_init_creds_password"
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr "用于日志记录的 Tevent 链 ID"
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr "检查 PAC 标志"
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr "talloc_asprintf 失败。\n"
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr "set_debug_file_from_fd 失败。\n"
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr "信息提供者的域（强制）"
 
@@ -2046,140 +2048,140 @@ msgstr "发生错误，但找不到描述信息。"
 msgid "Unexpected error while looking for an error description"
 msgstr "查找错误说明时出现意外错误"
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr "权限被拒绝。 "
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "服务器消息： "
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr "输入 PIN："
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "密码不匹配"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr "不支持通过 root 重置密码。"
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr "通过缓存的凭据进行身份验证"
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr "，您缓存的密码将过期于： "
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr "您的密码已过期。您有 %1$d 剩余宽限登陆。"
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr "您的密码将于 %1$d %2$s 过期。"
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, c-format
 msgid "Your password has expired."
 msgstr "您的密码已经过期。"
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr "身份验证被拒绝，直到： "
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "系统离线，无法更改密码"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr "更改 OTP 密码后，您需要注销并重新登录以获得票证"
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr "PIN 已锁定"
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "更改密码失败。 "
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr "在 %1$s 处进行身份验证，然后按 ENTER 。"
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr "在 %2$s 处使用 PIN %1$s 进行身份验证，然后按 ENTER 。"
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr "请（重新）插入（不同的）智能卡"
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "新密码： "
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "重新输入新密码： "
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr "第一因素： "
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr "第二因素（可选）： "
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr "第二因素： "
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr "插入您的通行密钥设备，然后按回车键。"
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "密码： "
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr "第一因素（当前密码）： "
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "当前密码： "
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "密码已过期。立即更改密码。"
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr "要运行的调试级别"
 
@@ -2188,7 +2190,7 @@ msgstr "要运行的调试级别"
 msgid "The SSSD domain to use"
 msgstr "要使用的 SSSD 域"
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "地区设置错误\n"
 
@@ -2250,95 +2252,99 @@ msgstr "sss_ssh_knownhostsproxy: 连接至主机 %s 端口 %d : %s\n"
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr "sss_ssh_knownhostsproxy：无法解析主机名 %s\n"
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr "没有符合指定搜索条件的缓存对象\n"
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr "无法使 %1$s 无效\n"
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr "无法使 %1$s %2$s 无效\n"
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr "使所有缓存的条目无效"
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr "使特定用户无效"
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr "使所有用户无效"
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr "使特定组无效"
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr "使所有组无效"
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr "使特定 netgroup 无效"
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr "使所有 netgroup 无效"
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr "使特定服务无效"
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr "使所有服务无效"
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr "使特定 autofs 映射无效"
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr "使所有 autofs 映射无效"
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr "使特定 SSH 主机无效"
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr "使所有 SSH 主机无效"
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr "使特定 sudo 规则无效"
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr "使所有缓存的 sudo 规则无效"
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr "使来自特定域的项无效"
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr "提供了意外的参数，使单个对象无效的选项仅接受单个参数。\n"
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr "请选择至少一个对象以使其无效\n"
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
@@ -2347,7 +2353,7 @@ msgstr ""
 "无法打开域 %1$s 。如果域是子域（受信任的域），请使用完全限定名而不是 --"
 "domain/-d 参数。\n"
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr "无法打开可用域\n"
 
@@ -2381,163 +2387,163 @@ msgstr "无法读取用户输入\n"
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr "无效输入，请提供 '%s' 或 '%s'。\n"
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr "执行外部命令时出错\n"
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr "执行外部命令 '%s' 时出错\n"
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr "命令 '%s' 失败代码 [%d]\n"
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr "需要运行 SSSD。现在启动 SSSD？"
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr "SSSD 不能运行。现在停止 SSSD？"
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr "需要重新运行 SSSD。现在重新运行 SSSD？"
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr "SSSD 状态："
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr "列出可用的域"
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr "打印有关域的信息"
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr "打印有关用户的信息，并检查身份验证"
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr "为域生成访问报告"
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr "有关缓存内容的信息："
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 msgid "Information about cached user"
 msgstr "有关缓存用户的信息"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr "有关缓存组的信息"
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr "有关缓存的 netgroup 的信息"
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr "本地数据工具："
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr "备份本地数据"
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr "从备份中恢复本地数据"
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr "备份本地数据，并删除缓存的内容"
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr "无效的缓存对象"
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr "管理缓存索引"
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr "日志文件工具："
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr "删除现有 SSSD 日志文件"
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr "以 tarball 形式归档 SSSD 日志文件"
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr "更改或打印有关 SSSD 调试级别的信息"
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr "分析日志记录的数据"
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr "配置文件工具："
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr "执行 SSSD 配置的静态分析"
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr "认证相关的工具："
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr "打印有关证书的信息"
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr "显示映射到证书的用户"
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr "使用证书检查映射并匹配规则"
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 #, fuzzy
 msgid "GPOs related tools:"
 msgstr "与 Passkey 相关的工具："
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "有关缓存用户的信息"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr "与 Passkey 相关的工具："
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr "执行通行密钥登记"
 
@@ -2592,7 +2598,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr "错误：无法获得对象 [%d]: %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr "%s: 无法读取值 [%d]: %s\n"
@@ -2606,217 +2612,217 @@ msgstr "指定名称。"
 msgid "Unable to parse name %s.\n"
 msgstr "无法解析名称 %s 。\n"
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr "使用 SID 搜索"
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr "使用用户 ID 搜索"
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr "Initgroups 过期时间"
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr "使用组 ID 搜索"
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 #, fuzzy
 msgid "Search by GPO guid"
 msgstr "使用组 ID 搜索"
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, fuzzy, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr "无法解析命令参数\n"
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, fuzzy, c-format
 msgid "Failed to print object: %s\n"
 msgstr "打开失败： %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 #, fuzzy
 msgid "talloc failed\n"
 msgstr "malloc 失败。\n"
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 #, fuzzy
 msgid "Unable to get attribute list!\n"
 msgstr "无法获取服务器列表\n"
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 #, fuzzy
 msgid "Unable to create filter\n"
 msgstr "无法删除缓存文件\n"
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 #, fuzzy
 msgid "Unable to get GPOs base DN\n"
 msgstr "无法获取服务器列表\n"
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, fuzzy, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr "无法归档日志文件\n"
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, fuzzy, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr "无法连接到系统总线!\n"
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr "\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, fuzzy, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr "无法删除日志文件\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, fuzzy, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr "打开失败： %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 #, fuzzy
 msgid "Could not determine object domain\n"
 msgstr "无法打开可用域\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, fuzzy, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr "打开失败： %s\n"
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr "显示调试信息"
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr "指定 base64 编码的证书。"
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr "无法连接到系统总线!\n"
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr " - 未找到映射用户 -"
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr "映射规则"
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr "匹配规则"
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr "无法解析命令参数\n"
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr "无可用的内存！\n"
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr "设置 certmap 上下文失败。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr "添加映射和匹配规则失败，错误为 [%d][%s]。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr "解码 base64 字符串失败。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr "证书与规则匹配。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr "证书与规则不匹配。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr "证书匹配 [%d][%s] 过程中的错误。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr "生成映射过滤器 [%d][%s]失败。\n"
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2829,7 +2835,7 @@ msgstr ""
 "    %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
@@ -2838,35 +2844,35 @@ msgstr ""
 "指定非默认 snippet dir（默认为在主配置文件所在的相同位置查找）。例如，如果配"
 "置被设置为 \"/my/path/sssd.conf\", snippet dir 为 \"/my/path/conf.d\" ）"
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr "文件 %1$s 不存在。\n"
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr "没有任何配置。\n"
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, fuzzy, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr "打开失败： %s\n"
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr "运行验证器失败"
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr "验证者发现了问题： %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr "配置合并期间生成的消息： %zu\n"
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr "所使用的配置摘要文件： %zu\n"
@@ -2888,100 +2894,100 @@ msgstr "无法导出用户覆盖\n"
 msgid "Unable to export group overrides\n"
 msgstr "无法导出组覆盖\n"
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr "覆盖现有的备份"
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr "无法导入用户覆盖\n"
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr "无法导入组覆盖\n"
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr "如果未运行，启动 SSSD"
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr "数据导入后重新启动 SSSD"
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr "创建干净的缓存文件并导入本地数据"
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr "在删除缓存之前停止 SSSD"
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr "删除缓存后启动 SSSD"
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr "正在创建本地数据备份...\n"
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr "无法创建本地数据备份，无法删除缓存。\n"
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr "删除缓存文件...\n"
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr "无法删除缓存文件\n"
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr "恢复本地数据...\n"
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr "为域 %1$s 创建缓存索引\n"
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr "删除域 %1$s 的缓存索引\n"
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr "域 %1$s 的索引：\n"
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr "  属性: %1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr "以特定域为目标"
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "domain"
 msgstr "域"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr "属性到索引"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr "属性"
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 msgid "Action not provided\n"
 msgstr "未提供操作\n"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
@@ -2990,180 +2996,180 @@ msgstr ""
 "未知操作：%1$s \n"
 " 有效的操作为 \"%2$s\"、\"%3$s 和 \"%4$s\"\n"
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr "未提供属性(-a)\n"
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr "属性 %1$s 未索引。\n"
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr "属性 %1$s 已索引。\n"
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr "索引操作失败：%1$s\n"
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr "不要忘记还要更新对远程提供程序的索引。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr "显示域列表，包括主要或受信任的域类型"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr "在线"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr "离线"
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr "在线状态： %s\n"
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr "这个域没有活跃的服务器。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr "活动服务器：\n"
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr "未连接"
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr "没有发现服务器。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr "发现的 %s 服务器：\n"
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr "到目前为止没有。\n"
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr "显示在线状态"
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr "显示有关活动服务器的信息"
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr "显示发现的服务器列表"
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr "指定域名。"
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr "无法获得在线状态\n"
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr "无法获取服务器列表\n"
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr "SSSD 未运行。\n"
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr "%1$-25s %2$#.4x\n"
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr "%1$-25s 未知域类型\n"
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr "%1$-25s 无法访问的服务\n"
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr "删除日志文件而不是截断"
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr "删除日志文件...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr "无法删除日志文件\n"
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr "截断日志文件...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr "无法截断日志文件\n"
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr "将日志文件归档到 %s ...\n"
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr "无法归档日志文件\n"
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr "以 SSSD 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr "以 NSS 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr "以 PAM 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr "以 SUDO 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr "以 AUTOFS 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr "以 SSH 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr "以 PAC 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr "以 IFP 服务为目标"
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr "指定要设置的调试级别"
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr "ERROR：缺少 Tevent 链 ID 支持，不支持日志分析器。\n"
 
@@ -3228,19 +3234,19 @@ msgstr ""
 " - shell: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr "PAM 操作 [auth|acct|setc|chau|open|clos]，默认： "
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr "PAM 服务，默认： "
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr "指定用户名。"
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3253,22 +3259,22 @@ msgstr ""
 "服务：%s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr "使用 [%s] 进行用户名查找失败。\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr "使用 [%s] 进行 InfoPipe 用户查找失败。\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr "pam_start 失败： %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
@@ -3276,12 +3282,12 @@ msgstr ""
 "测试 pam_authenticate\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr "pam_get_item 失败： %s\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
@@ -3290,7 +3296,7 @@ msgstr ""
 "pam_authenticate 用户 [%s]: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
@@ -3298,7 +3304,7 @@ msgstr ""
 "测试 pam_chauthtok\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
@@ -3307,7 +3313,7 @@ msgstr ""
 "pam_chauthtok: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
@@ -3315,7 +3321,7 @@ msgstr ""
 "测试 pam_acct_mgmt\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
@@ -3324,7 +3330,7 @@ msgstr ""
 "pam_acct_mgmt: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
@@ -3332,7 +3338,7 @@ msgstr ""
 "测试 pam_setcred\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
@@ -3341,7 +3347,7 @@ msgstr ""
 "pam_setcred: [%s]\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
@@ -3349,7 +3355,7 @@ msgstr ""
 "测试 pam_open_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
@@ -3358,7 +3364,7 @@ msgstr ""
 "pam_open_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
@@ -3366,7 +3372,7 @@ msgstr ""
 "测试 pam_close_session\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
@@ -3375,26 +3381,29 @@ msgstr ""
 "pam_close_session: %s\n"
 "\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr "未知操作\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr "PAM 环境：\n"
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr " -没有环境-\n"
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "指定一个非默认的配置文件"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr "通知响应者已被套接字激活"
 
+#~ msgid "Number of times to attempt connection to Data Providers"
+#~ msgstr "试图连接到 Data Providers 的次数"
+
 #~ msgid "Disable netlink interface"
 #~ msgstr "禁用 netlink 接口"
 
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 0a88896cb2d..54a22adee4a 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org\n"
-"POT-Creation-Date: 2024-06-25 13:26+0200\n"
+"POT-Creation-Date: 2024-10-15 11:45+0200\n"
 "PO-Revision-Date: 2014-12-14 11:50-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Chinese (Taiwan) (http://www.transifex.com/projects/p/sssd/"
@@ -45,26 +45,22 @@ msgid "Command to start service"
 msgstr "啟動服務的指令"
 
 #: src/config/SSSDConfig/sssdoptions.py:27
-msgid "Number of times to attempt connection to Data Providers"
-msgstr ""
-
-#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "The number of file descriptors that may be opened by this responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:29
+#: src/config/SSSDConfig/sssdoptions.py:28
 msgid "Idle time before automatic disconnection of a client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:30
+#: src/config/SSSDConfig/sssdoptions.py:29
 msgid "Idle time before automatic shutdown of the responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:31
+#: src/config/SSSDConfig/sssdoptions.py:30
 msgid "Always query all the caches before querying the Data Providers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:32
+#: src/config/SSSDConfig/sssdoptions.py:31
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected. This value "
@@ -72,63 +68,63 @@ msgid ""
 "random_offset."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:37
+#: src/config/SSSDConfig/sssdoptions.py:36
 msgid "SSSD Services to start"
 msgstr "要啟動的 SSSD 服務"
 
-#: src/config/SSSDConfig/sssdoptions.py:38
+#: src/config/SSSDConfig/sssdoptions.py:37
 msgid "SSSD Domains to start"
 msgstr "要啟動的 SSSD 網域"
 
-#: src/config/SSSDConfig/sssdoptions.py:39
+#: src/config/SSSDConfig/sssdoptions.py:38
 msgid "Regex to parse username and domain"
 msgstr "用來解析使用者名稱與網域的正規表示式"
 
-#: src/config/SSSDConfig/sssdoptions.py:40
+#: src/config/SSSDConfig/sssdoptions.py:39
 msgid "Printf-compatible format for displaying fully-qualified names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:41
+#: src/config/SSSDConfig/sssdoptions.py:40
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:42
+#: src/config/SSSDConfig/sssdoptions.py:41
 msgid "Domain to add to names without a domain component."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:43
+#: src/config/SSSDConfig/sssdoptions.py:42
 msgid "The user to drop privileges to"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:44
+#: src/config/SSSDConfig/sssdoptions.py:43
 msgid "Tune certificate verification"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:45
+#: src/config/SSSDConfig/sssdoptions.py:44
 msgid "All spaces in group or user names will be replaced with this character"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:46
+#: src/config/SSSDConfig/sssdoptions.py:45
 msgid "Tune sssd to honor or ignore netlink state changes"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:47
+#: src/config/SSSDConfig/sssdoptions.py:46
 msgid "Enable or disable the implicit files domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:48
+#: src/config/SSSDConfig/sssdoptions.py:47
 msgid "A specific order of the domains to be looked up"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:49
+#: src/config/SSSDConfig/sssdoptions.py:48
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:51
+#: src/config/SSSDConfig/sssdoptions.py:50
 msgid ""
 "SSSD monitors the state of resolv.conf to identify when it needs to update "
 "its internal DNS resolver. By default, we will attempt to use inotify for "
@@ -136,1133 +132,1139 @@ msgid ""
 "inotify cannot be used."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:54
+#: src/config/SSSDConfig/sssdoptions.py:53
 msgid "Run PAC responder automatically for AD and IPA provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:55
+#: src/config/SSSDConfig/sssdoptions.py:54
 msgid "Enable or disable core dumps for all SSSD processes."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:56
+#: src/config/SSSDConfig/sssdoptions.py:55
 msgid "Tune passkey verification behavior"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:59
+#: src/config/SSSDConfig/sssdoptions.py:58
 msgid "Enumeration cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:59
 msgid "Entry cache background update timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:61
-#: src/config/SSSDConfig/sssdoptions.py:126
+#: src/config/SSSDConfig/sssdoptions.py:60
+#: src/config/SSSDConfig/sssdoptions.py:125
 msgid "Negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:62
+#: src/config/SSSDConfig/sssdoptions.py:61
 msgid "Files negative cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:63
+#: src/config/SSSDConfig/sssdoptions.py:62
 msgid "Users that SSSD should explicitly ignore"
 msgstr "SSSD 應該明確忽略的使用者"
 
-#: src/config/SSSDConfig/sssdoptions.py:64
+#: src/config/SSSDConfig/sssdoptions.py:63
 msgid "Groups that SSSD should explicitly ignore"
 msgstr "SSSD 應該明確忽略的群組"
 
-#: src/config/SSSDConfig/sssdoptions.py:65
+#: src/config/SSSDConfig/sssdoptions.py:64
 msgid "Should filtered users appear in groups"
 msgstr "過濾的使用者是否應該顯現在群組內"
 
-#: src/config/SSSDConfig/sssdoptions.py:66
+#: src/config/SSSDConfig/sssdoptions.py:65
 msgid "The value of the password field the NSS provider should return"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:67
+#: src/config/SSSDConfig/sssdoptions.py:66
 msgid "Override homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:68
+#: src/config/SSSDConfig/sssdoptions.py:67
 msgid ""
 "Substitute empty homedir value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:69
+#: src/config/SSSDConfig/sssdoptions.py:68
 msgid "Override shell value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:70
+#: src/config/SSSDConfig/sssdoptions.py:69
 msgid "The list of shells users are allowed to log in with"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:71
+#: src/config/SSSDConfig/sssdoptions.py:70
 msgid ""
 "The list of shells that will be vetoed, and replaced with the fallback shell"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:72
+#: src/config/SSSDConfig/sssdoptions.py:71
 msgid ""
 "If a shell stored in central directory is allowed but not available, use "
 "this fallback"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:73
+#: src/config/SSSDConfig/sssdoptions.py:72
 msgid "Shell to use if the provider does not list one"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:74
+#: src/config/SSSDConfig/sssdoptions.py:73
 msgid "How long will be in-memory cache records valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:76
+#: src/config/SSSDConfig/sssdoptions.py:75
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:78
+#: src/config/SSSDConfig/sssdoptions.py:77
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:80
+#: src/config/SSSDConfig/sssdoptions.py:79
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:81
+#: src/config/SSSDConfig/sssdoptions.py:80
 msgid ""
 "The value of this option will be used in the expansion of the "
 "override_homedir option if the template contains the format string %H."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:83
+#: src/config/SSSDConfig/sssdoptions.py:82
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:85
+#: src/config/SSSDConfig/sssdoptions.py:84
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
 "for the domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:90
+#: src/config/SSSDConfig/sssdoptions.py:89
 msgid "How long to allow cached logins between online logins (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:91
+#: src/config/SSSDConfig/sssdoptions.py:90
 msgid "How many failed logins attempts are allowed when offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:93
+#: src/config/SSSDConfig/sssdoptions.py:92
 msgid ""
 "How long (minutes) to deny login after offline_failed_login_attempts has "
 "been reached"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:94
+#: src/config/SSSDConfig/sssdoptions.py:93
 msgid "What kind of messages are displayed to the user during authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:95
+#: src/config/SSSDConfig/sssdoptions.py:94
 msgid "Filter PAM responses sent to the pam_sss"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:96
+#: src/config/SSSDConfig/sssdoptions.py:95
 msgid "How many seconds to keep identity information cached for PAM requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:97
+#: src/config/SSSDConfig/sssdoptions.py:96
 msgid "How many days before password expiration a warning should be displayed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:98
+#: src/config/SSSDConfig/sssdoptions.py:97
 msgid "List of trusted uids or user's name"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:99
+#: src/config/SSSDConfig/sssdoptions.py:98
 msgid "List of domains accessible even for untrusted users."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:100
+#: src/config/SSSDConfig/sssdoptions.py:99
 msgid "Message printed when user account is expired."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:101
+#: src/config/SSSDConfig/sssdoptions.py:100
 msgid "Message printed when user account is locked."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:102
+#: src/config/SSSDConfig/sssdoptions.py:101
 msgid "Allow certificate based/Smartcard authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:103
+#: src/config/SSSDConfig/sssdoptions.py:102
 msgid "Path to certificate database with PKCS#11 modules."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:104
+#: src/config/SSSDConfig/sssdoptions.py:103
 #, fuzzy
 msgid "Tune certificate verification for PAM authentication."
 msgstr "需要 TLS 憑證驗證"
 
-#: src/config/SSSDConfig/sssdoptions.py:105
+#: src/config/SSSDConfig/sssdoptions.py:104
 msgid "How many seconds will pam_sss wait for p11_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:106
+#: src/config/SSSDConfig/sssdoptions.py:105
 msgid "Which PAM services are permitted to contact application domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:107
+#: src/config/SSSDConfig/sssdoptions.py:106
 msgid "Allowed services for using smartcards"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:108
+#: src/config/SSSDConfig/sssdoptions.py:107
 msgid "Additional timeout to wait for a card if requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:109
+#: src/config/SSSDConfig/sssdoptions.py:108
 msgid ""
 "PKCS#11 URI to restrict the selection of devices for Smartcard authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:110
+#: src/config/SSSDConfig/sssdoptions.py:109
 msgid "When shall the PAM responder force an initgroups request"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:111
+#: src/config/SSSDConfig/sssdoptions.py:110
 msgid "List of PAM services that are allowed to authenticate with GSSAPI."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:112
+#: src/config/SSSDConfig/sssdoptions.py:111
 msgid "Whether to match authenticated UPN with target user"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:113
+#: src/config/SSSDConfig/sssdoptions.py:112
 msgid ""
 "List of pairs <PAM service>:<authentication indicator> that must be enforced "
 "for PAM access with GSSAPI authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:115
+#: src/config/SSSDConfig/sssdoptions.py:114
 msgid "Allow passkey device authentication."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:116
+#: src/config/SSSDConfig/sssdoptions.py:115
 msgid "How many seconds will pam_sss wait for passkey_child to finish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:117
+#: src/config/SSSDConfig/sssdoptions.py:116
 msgid "Enable debugging in the libfido2 library"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:120
+#: src/config/SSSDConfig/sssdoptions.py:119
 msgid "Whether to evaluate the time-based attributes in sudo rules"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:121
+#: src/config/SSSDConfig/sssdoptions.py:120
 msgid "If true, SSSD will switch back to lower-wins ordering logic"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:122
+#: src/config/SSSDConfig/sssdoptions.py:121
 msgid ""
 "Maximum number of rules that can be refreshed at once. If this is exceeded, "
 "full refresh is performed."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:129
+#: src/config/SSSDConfig/sssdoptions.py:128
 msgid "Whether to hash host names and addresses in the known_hosts file"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:130
+#: src/config/SSSDConfig/sssdoptions.py:129
 msgid ""
 "How many seconds to keep a host in the known_hosts file after its host keys "
 "were requested"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:132
+#: src/config/SSSDConfig/sssdoptions.py:131
 msgid "Path to storage of trusted CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:133
+#: src/config/SSSDConfig/sssdoptions.py:132
 msgid "Allow to generate ssh-keys from certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:134
+#: src/config/SSSDConfig/sssdoptions.py:133
 msgid ""
 "Use the following matching rules to filter the certificates for ssh-key "
 "generation"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:138
+#: src/config/SSSDConfig/sssdoptions.py:137
 msgid "List of UIDs or user names allowed to access the PAC responder"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:139
+#: src/config/SSSDConfig/sssdoptions.py:138
 msgid "How long the PAC data is considered valid"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:140
+#: src/config/SSSDConfig/sssdoptions.py:139
 msgid "Validate the PAC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:143
+#: src/config/SSSDConfig/sssdoptions.py:142
 msgid "List of user attributes the InfoPipe is allowed to publish"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:146
+#: src/config/SSSDConfig/sssdoptions.py:145
 msgid ""
 "One of the following strings specifying the scope of session recording: none "
 "- No users are recorded. some - Users/groups specified by users and groups "
 "options are recorded. all - All users are recorded."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:149
+#: src/config/SSSDConfig/sssdoptions.py:148
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
 "replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:151
+#: src/config/SSSDConfig/sssdoptions.py:150
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
 "possible space replacement, case changes, etc."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:154
+#: src/config/SSSDConfig/sssdoptions.py:153
 msgid ""
 "A comma-separated list of users to be excluded from recording, only when "
 "scope=all"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:155
+#: src/config/SSSDConfig/sssdoptions.py:154
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording,  only when scope=all. "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:159
+#: src/config/SSSDConfig/sssdoptions.py:158
 msgid "Identity provider"
 msgstr "身分提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:160
+#: src/config/SSSDConfig/sssdoptions.py:159
 msgid "Authentication provider"
 msgstr "認證提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:161
+#: src/config/SSSDConfig/sssdoptions.py:160
 msgid "Access control provider"
 msgstr "存取控制提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:162
+#: src/config/SSSDConfig/sssdoptions.py:161
 msgid "Password change provider"
 msgstr "密碼變更提供者"
 
-#: src/config/SSSDConfig/sssdoptions.py:163
+#: src/config/SSSDConfig/sssdoptions.py:162
 msgid "SUDO provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:164
+#: src/config/SSSDConfig/sssdoptions.py:163
 msgid "Autofs provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:165
+#: src/config/SSSDConfig/sssdoptions.py:164
 msgid "Host identity provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:166
+#: src/config/SSSDConfig/sssdoptions.py:165
 msgid "SELinux provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:167
+#: src/config/SSSDConfig/sssdoptions.py:166
 msgid "Session management provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:168
+#: src/config/SSSDConfig/sssdoptions.py:167
 msgid "Resolver provider"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:171
+#: src/config/SSSDConfig/sssdoptions.py:170
 msgid "Whether the domain is usable by the OS or by applications"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:172
+#: src/config/SSSDConfig/sssdoptions.py:171
 #, fuzzy
 msgid "Enable or disable the domain"
 msgstr "啟用憑證驗證"
 
-#: src/config/SSSDConfig/sssdoptions.py:173
+#: src/config/SSSDConfig/sssdoptions.py:172
 msgid "Minimum user ID"
 msgstr "最小的使用者 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:174
+#: src/config/SSSDConfig/sssdoptions.py:173
 msgid "Maximum user ID"
 msgstr "最大的使用者 ID"
 
-#: src/config/SSSDConfig/sssdoptions.py:175
+#: src/config/SSSDConfig/sssdoptions.py:174
 msgid "Enable enumerating all users/groups"
 msgstr "啟用所有使用者或群組的列舉"
 
-#: src/config/SSSDConfig/sssdoptions.py:176
+#: src/config/SSSDConfig/sssdoptions.py:175
 msgid "Cache credentials for offline login"
 msgstr "供離線登入使用的快取憑證"
 
-#: src/config/SSSDConfig/sssdoptions.py:177
+#: src/config/SSSDConfig/sssdoptions.py:176
 msgid "Display users/groups in fully-qualified form"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:177
 msgid "Don't include group members in group lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:179
+#: src/config/SSSDConfig/sssdoptions.py:178
+#: src/config/SSSDConfig/sssdoptions.py:190
 #: src/config/SSSDConfig/sssdoptions.py:191
 #: src/config/SSSDConfig/sssdoptions.py:192
 #: src/config/SSSDConfig/sssdoptions.py:193
 #: src/config/SSSDConfig/sssdoptions.py:194
 #: src/config/SSSDConfig/sssdoptions.py:195
 #: src/config/SSSDConfig/sssdoptions.py:196
-#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "Entry cache timeout length (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:180
+#: src/config/SSSDConfig/sssdoptions.py:179
 msgid ""
 "Restrict or prefer a specific address family when performing DNS lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:181
+#: src/config/SSSDConfig/sssdoptions.py:180
 msgid "How long to keep cached entries after last successful login (days)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:182
+#: src/config/SSSDConfig/sssdoptions.py:181
 msgid ""
 "How long should SSSD talk to single DNS server before trying next server "
 "(miliseconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:184
+#: src/config/SSSDConfig/sssdoptions.py:183
 msgid "How long should keep trying to resolve single DNS query (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:185
+#: src/config/SSSDConfig/sssdoptions.py:184
 msgid "How long to wait for replies from DNS when resolving servers (seconds)"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:186
+#: src/config/SSSDConfig/sssdoptions.py:185
 msgid "The domain part of service discovery DNS query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:187
+#: src/config/SSSDConfig/sssdoptions.py:186
 msgid ""
 "Specifies the interval, in seconds, that SSSD waits before attempting to "
 "reconnect to the primary server after a successful connection to the backup "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:189
+#: src/config/SSSDConfig/sssdoptions.py:188
 msgid "Override GID value from the identity provider with this value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:190
+#: src/config/SSSDConfig/sssdoptions.py:189
 msgid "Treat usernames as case sensitive"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:198
+#: src/config/SSSDConfig/sssdoptions.py:197
 msgid "How often should expired entries be refreshed in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:199
+#: src/config/SSSDConfig/sssdoptions.py:198
 msgid "Maximum period deviation when refreshing expired entries in background"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:199
 msgid "Whether to automatically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:201
-#: src/config/SSSDConfig/sssdoptions.py:234
+#: src/config/SSSDConfig/sssdoptions.py:200
+#: src/config/SSSDConfig/sssdoptions.py:233
 msgid "The TTL to apply to the client's DNS entry after updating it"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:202
-#: src/config/SSSDConfig/sssdoptions.py:235
+#: src/config/SSSDConfig/sssdoptions.py:201
+#: src/config/SSSDConfig/sssdoptions.py:234
 msgid "The interface whose IP should be used for dynamic DNS updates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:203
+#: src/config/SSSDConfig/sssdoptions.py:202
 msgid "How often to periodically update the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:204
+#: src/config/SSSDConfig/sssdoptions.py:203
 msgid "Maximum period deviation when updating the client's DNS entry"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:205
+#: src/config/SSSDConfig/sssdoptions.py:204
 msgid "Whether the provider should explicitly update the PTR record as well"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:206
+#: src/config/SSSDConfig/sssdoptions.py:205
 msgid "Whether the nsupdate utility should default to using TCP"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:207
+#: src/config/SSSDConfig/sssdoptions.py:206
 msgid "What kind of authentication should be used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:208
+#: src/config/SSSDConfig/sssdoptions.py:207
 msgid "Override the DNS server used to perform the DNS update"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:209
+#: src/config/SSSDConfig/sssdoptions.py:208
 msgid "Control enumeration of trusted domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:210
+#: src/config/SSSDConfig/sssdoptions.py:209
 msgid "How often should subdomains list be refreshed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:211
+#: src/config/SSSDConfig/sssdoptions.py:210
 msgid "Maximum period deviation when refreshing the subdomain list"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:212
+#: src/config/SSSDConfig/sssdoptions.py:211
 msgid "List of options that should be inherited into a subdomain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:213
+#: src/config/SSSDConfig/sssdoptions.py:212
 msgid "Default subdomain homedir value"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:214
+#: src/config/SSSDConfig/sssdoptions.py:213
 msgid "How long can cached credentials be used for cached authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:215
+#: src/config/SSSDConfig/sssdoptions.py:214
 msgid "Whether to automatically create private groups for users"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:216
+#: src/config/SSSDConfig/sssdoptions.py:215
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:217
+#: src/config/SSSDConfig/sssdoptions.py:216
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:218
+#: src/config/SSSDConfig/sssdoptions.py:217
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:220
+#: src/config/SSSDConfig/sssdoptions.py:219
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:222
+#: src/config/SSSDConfig/sssdoptions.py:221
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
 "(long term password) must have to be saved as SHA512 hash into the cache."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:226
+#: src/config/SSSDConfig/sssdoptions.py:225
 msgid "Local authentication methods policy "
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:229
+#: src/config/SSSDConfig/sssdoptions.py:228
 msgid "IPA domain"
 msgstr "IPA 網域"
 
-#: src/config/SSSDConfig/sssdoptions.py:230
+#: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA server address"
 msgstr "IPA 伺服器位址"
 
-#: src/config/SSSDConfig/sssdoptions.py:231
+#: src/config/SSSDConfig/sssdoptions.py:230
 msgid "Address of backup IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:232
+#: src/config/SSSDConfig/sssdoptions.py:231
 msgid "IPA client hostname"
 msgstr "IPA 客戶端主機名稱"
 
-#: src/config/SSSDConfig/sssdoptions.py:233
+#: src/config/SSSDConfig/sssdoptions.py:232
 msgid "Whether to automatically update the client's DNS entry in FreeIPA"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:236
+#: src/config/SSSDConfig/sssdoptions.py:235
 msgid "Search base for HBAC related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:237
+#: src/config/SSSDConfig/sssdoptions.py:236
 msgid ""
 "The amount of time between lookups of the HBAC rules against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:238
+#: src/config/SSSDConfig/sssdoptions.py:237
 msgid ""
 "The amount of time in seconds between lookups of the SELinux maps against "
 "the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:240
+#: src/config/SSSDConfig/sssdoptions.py:239
 msgid "If set to false, host argument given by PAM will be ignored"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:241
+#: src/config/SSSDConfig/sssdoptions.py:240
 msgid "The automounter location this IPA client is using"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:242
+#: src/config/SSSDConfig/sssdoptions.py:241
 msgid "Search base for object containing info about IPA domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:242
 msgid "Search base for objects containing info about ID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:244
-#: src/config/SSSDConfig/sssdoptions.py:300
+#: src/config/SSSDConfig/sssdoptions.py:243
+#: src/config/SSSDConfig/sssdoptions.py:299
 msgid "Enable DNS sites - location based service discovery"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:245
+#: src/config/SSSDConfig/sssdoptions.py:244
 msgid "Search base for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:246
+#: src/config/SSSDConfig/sssdoptions.py:245
 msgid "Objectclass for view containers"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:247
+#: src/config/SSSDConfig/sssdoptions.py:246
 msgid "Attribute with the name of the view"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:248
+#: src/config/SSSDConfig/sssdoptions.py:247
 msgid "Objectclass for override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:249
+#: src/config/SSSDConfig/sssdoptions.py:248
 msgid "Attribute with the reference to the original object"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:250
+#: src/config/SSSDConfig/sssdoptions.py:249
 msgid "Objectclass for user override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:251
+#: src/config/SSSDConfig/sssdoptions.py:250
 msgid "Objectclass for group override objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:252
+#: src/config/SSSDConfig/sssdoptions.py:251
 msgid "Search base for Desktop Profile related objects"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:253
+#: src/config/SSSDConfig/sssdoptions.py:252
 msgid ""
 "The amount of time in seconds between lookups of the Desktop Profile rules "
 "against the IPA server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:255
+#: src/config/SSSDConfig/sssdoptions.py:254
 msgid ""
 "The amount of time in minutes between lookups of Desktop Profiles rules "
 "against the IPA server when the last request did not find any rule"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:258
+#: src/config/SSSDConfig/sssdoptions.py:257
 msgid "Search base for SUBID ranges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:259
+#: src/config/SSSDConfig/sssdoptions.py:258
 #: src/config/SSSDConfig/sssdoptions.py:503
 msgid "Which rules should be used to evaluate access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:259
 msgid "The LDAP attribute that contains FQDN of the host."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:261
-#: src/config/SSSDConfig/sssdoptions.py:284
+#: src/config/SSSDConfig/sssdoptions.py:260
+#: src/config/SSSDConfig/sssdoptions.py:283
 msgid "The object class of a host entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:262
+#: src/config/SSSDConfig/sssdoptions.py:261
 msgid "Use the given string as search base for host objects."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:263
+#: src/config/SSSDConfig/sssdoptions.py:262
 msgid "The LDAP attribute that contains the host's SSH public keys."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:264
+#: src/config/SSSDConfig/sssdoptions.py:263
 msgid "The LDAP attribute that contains NIS domain name of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:265
+#: src/config/SSSDConfig/sssdoptions.py:264
 msgid "The LDAP attribute that contains the names of the netgroup's members."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:266
+#: src/config/SSSDConfig/sssdoptions.py:265
 msgid ""
 "The LDAP attribute that lists FQDNs of hosts and host groups that are "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:268
+#: src/config/SSSDConfig/sssdoptions.py:267
 msgid ""
 "The LDAP attribute that lists hosts and host groups that are direct members "
 "of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:270
+#: src/config/SSSDConfig/sssdoptions.py:269
 msgid "The LDAP attribute that lists netgroup's memberships."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:271
+#: src/config/SSSDConfig/sssdoptions.py:270
 msgid ""
 "The LDAP attribute that lists system users and groups that are direct "
 "members of the netgroup."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:273
+#: src/config/SSSDConfig/sssdoptions.py:272
 msgid "The LDAP attribute that corresponds to the netgroup name."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:274
+#: src/config/SSSDConfig/sssdoptions.py:273
 msgid "The object class of a netgroup entry in LDAP."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:275
+#: src/config/SSSDConfig/sssdoptions.py:274
 msgid ""
 "The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:276
+#: src/config/SSSDConfig/sssdoptions.py:275
 msgid ""
 "The LDAP attribute that contains whether or not is user map enabled for "
 "usage."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:278
+#: src/config/SSSDConfig/sssdoptions.py:277
 msgid "The LDAP attribute that contains host category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:279
+#: src/config/SSSDConfig/sssdoptions.py:278
 msgid ""
 "The LDAP attribute that contains all hosts / hostgroups this rule match "
 "against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:281
+#: src/config/SSSDConfig/sssdoptions.py:280
 msgid ""
 "The LDAP attribute that contains all users / groups this rule match against."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:283
+#: src/config/SSSDConfig/sssdoptions.py:282
 msgid "The LDAP attribute that contains the name of SELinux usermap."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:285
+#: src/config/SSSDConfig/sssdoptions.py:284
 msgid ""
 "The LDAP attribute that contains DN of HBAC rule which can be used for "
 "matching instead of memberUser and memberHost."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:287
+#: src/config/SSSDConfig/sssdoptions.py:286
 msgid "The LDAP attribute that contains SELinux user string itself."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:288
+#: src/config/SSSDConfig/sssdoptions.py:287
 msgid "The LDAP attribute that contains user category such as 'all'."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:289
+#: src/config/SSSDConfig/sssdoptions.py:288
 msgid "The LDAP attribute that contains unique ID of the user map."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:290
+#: src/config/SSSDConfig/sssdoptions.py:289
 msgid ""
 "The option denotes that the SSSD is running on IPA server and should perform "
 "lookups of users and groups from trusted domains differently."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:292
+#: src/config/SSSDConfig/sssdoptions.py:291
 msgid "Use the given string as search base for trusted domains."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:295
+#: src/config/SSSDConfig/sssdoptions.py:294
 msgid "Active Directory domain"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:296
+#: src/config/SSSDConfig/sssdoptions.py:295
 msgid "Enabled Active Directory domains"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:297
+#: src/config/SSSDConfig/sssdoptions.py:296
 msgid "Active Directory server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:298
+#: src/config/SSSDConfig/sssdoptions.py:297
 msgid "Active Directory backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:299
+#: src/config/SSSDConfig/sssdoptions.py:298
 msgid "Active Directory client hostname"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:301
+#: src/config/SSSDConfig/sssdoptions.py:300
 #: src/config/SSSDConfig/sssdoptions.py:501
 msgid "LDAP filter to determine access privileges"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:302
+#: src/config/SSSDConfig/sssdoptions.py:301
 msgid "Whether to use the Global Catalog for lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:303
+#: src/config/SSSDConfig/sssdoptions.py:302
 msgid "Operation mode for GPO-based access control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:304
+#: src/config/SSSDConfig/sssdoptions.py:303
 msgid ""
 "The amount of time between lookups of the GPO policy files against the AD "
 "server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:305
+#: src/config/SSSDConfig/sssdoptions.py:304
 msgid ""
 "PAM service names that map to the GPO (Deny)InteractiveLogonRight policy "
 "settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:307
+#: src/config/SSSDConfig/sssdoptions.py:306
 msgid ""
 "PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight "
 "policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:309
+#: src/config/SSSDConfig/sssdoptions.py:308
 msgid ""
 "PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:310
+#: src/config/SSSDConfig/sssdoptions.py:309
 msgid ""
 "PAM service names that map to the GPO (Deny)BatchLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:311
+#: src/config/SSSDConfig/sssdoptions.py:310
 msgid ""
 "PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:312
+#: src/config/SSSDConfig/sssdoptions.py:311
 msgid "PAM service names for which GPO-based access is always granted"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:313
+#: src/config/SSSDConfig/sssdoptions.py:312
 msgid "PAM service names for which GPO-based access is always denied"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:314
+#: src/config/SSSDConfig/sssdoptions.py:313
 msgid ""
 "Default logon right (or permit/deny) to use for unmapped PAM service names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:315
+#: src/config/SSSDConfig/sssdoptions.py:314
 msgid "a particular site to be used by the client"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:316
+#: src/config/SSSDConfig/sssdoptions.py:315
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:318
+#: src/config/SSSDConfig/sssdoptions.py:317
 msgid "Option for tuning the machine account renewal task"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:319
+#: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Whether to update the machine account password in the Samba database"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:321
+#: src/config/SSSDConfig/sssdoptions.py:320
 msgid "Use LDAPS port for LDAP and Global Catalog requests"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:322
+#: src/config/SSSDConfig/sssdoptions.py:321
 msgid "Do not filter domain local groups from other domains"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:324
 #: src/config/SSSDConfig/sssdoptions.py:325
-#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos server address"
 msgstr "Kerberos 伺服器位址"
 
-#: src/config/SSSDConfig/sssdoptions.py:327
+#: src/config/SSSDConfig/sssdoptions.py:326
 msgid "Kerberos backup server address"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:328
+#: src/config/SSSDConfig/sssdoptions.py:327
 msgid "Kerberos realm"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:329
+#: src/config/SSSDConfig/sssdoptions.py:328
 msgid "Authentication timeout"
 msgstr "認證逾時"
 
-#: src/config/SSSDConfig/sssdoptions.py:330
+#: src/config/SSSDConfig/sssdoptions.py:329
 msgid "Whether to create kdcinfo files"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:331
+#: src/config/SSSDConfig/sssdoptions.py:330
 msgid "Where to drop krb5 config snippets"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:334
+#: src/config/SSSDConfig/sssdoptions.py:333
 msgid "Directory to store credential caches"
 msgstr "儲存憑證快取的目錄"
 
-#: src/config/SSSDConfig/sssdoptions.py:335
+#: src/config/SSSDConfig/sssdoptions.py:334
 msgid "Location of the user's credential cache"
 msgstr "使用者憑證快取的位置"
 
-#: src/config/SSSDConfig/sssdoptions.py:336
+#: src/config/SSSDConfig/sssdoptions.py:335
 msgid "Location of the keytab to validate credentials"
 msgstr "驗證憑證用的金鑰表格位置"
 
-#: src/config/SSSDConfig/sssdoptions.py:337
+#: src/config/SSSDConfig/sssdoptions.py:336
 msgid "Enable credential validation"
 msgstr "啟用憑證驗證"
 
-#: src/config/SSSDConfig/sssdoptions.py:338
+#: src/config/SSSDConfig/sssdoptions.py:337
 msgid "Store password if offline for later online authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:339
+#: src/config/SSSDConfig/sssdoptions.py:338
 msgid "Renewable lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:340
+#: src/config/SSSDConfig/sssdoptions.py:339
 msgid "Lifetime of the TGT"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:341
+#: src/config/SSSDConfig/sssdoptions.py:340
 msgid "Time between two checks for renewal"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:342
+#: src/config/SSSDConfig/sssdoptions.py:341
 msgid "Enables FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:343
+#: src/config/SSSDConfig/sssdoptions.py:342
 msgid "Selects the principal to use for FAST"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:344
+#: src/config/SSSDConfig/sssdoptions.py:343
 msgid "Use anonymous PKINIT to request FAST credentials"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:345
+#: src/config/SSSDConfig/sssdoptions.py:344
 msgid "Enables principal canonicalization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:346
+#: src/config/SSSDConfig/sssdoptions.py:345
 msgid "Enables enterprise principals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:347
+#: src/config/SSSDConfig/sssdoptions.py:346
 msgid "Enables using of subdomains realms for authentication"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:348
+#: src/config/SSSDConfig/sssdoptions.py:347
 msgid "A mapping from user names to Kerberos principal names"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:350
 #: src/config/SSSDConfig/sssdoptions.py:351
-#: src/config/SSSDConfig/sssdoptions.py:352
 msgid "Server where the change password service is running if not on the KDC"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:355
+#: src/config/SSSDConfig/sssdoptions.py:354
 msgid "ldap_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:356
+#: src/config/SSSDConfig/sssdoptions.py:355
 msgid "ldap_backup_uri, The URI of the LDAP server"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:357
+#: src/config/SSSDConfig/sssdoptions.py:356
 msgid "The default base DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:358
+#: src/config/SSSDConfig/sssdoptions.py:357
 msgid "The Schema Type in use on the LDAP server, rfc2307"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:359
+#: src/config/SSSDConfig/sssdoptions.py:358
 msgid "Mode used to change user password"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:360
+#: src/config/SSSDConfig/sssdoptions.py:359
 msgid "The default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:361
+#: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The type of the authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:362
+#: src/config/SSSDConfig/sssdoptions.py:361
 msgid "The authentication token of the default bind DN"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:363
+#: src/config/SSSDConfig/sssdoptions.py:362
 msgid "Length of time to attempt connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:364
+#: src/config/SSSDConfig/sssdoptions.py:363
 msgid "Length of time to attempt synchronous LDAP operations"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:365
+#: src/config/SSSDConfig/sssdoptions.py:364
 msgid "Length of time between attempts to reconnect while offline"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:366
+#: src/config/SSSDConfig/sssdoptions.py:365
 msgid "Use only the upper case for realm names"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:367
+#: src/config/SSSDConfig/sssdoptions.py:366
 msgid "File that contains CA certificates"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:368
+#: src/config/SSSDConfig/sssdoptions.py:367
 msgid "Path to CA certificate directory"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:369
+#: src/config/SSSDConfig/sssdoptions.py:368
 msgid "File that contains the client certificate"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:370
+#: src/config/SSSDConfig/sssdoptions.py:369
 msgid "File that contains the client key"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:371
+#: src/config/SSSDConfig/sssdoptions.py:370
 msgid "List of possible ciphers suites"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:372
+#: src/config/SSSDConfig/sssdoptions.py:371
 msgid "Require TLS certificate verification"
 msgstr "需要 TLS 憑證驗證"
 
-#: src/config/SSSDConfig/sssdoptions.py:373
+#: src/config/SSSDConfig/sssdoptions.py:372
 msgid "Specify the sasl mechanism to use"
 msgstr "指定要使用的 sasl 機制"
 
-#: src/config/SSSDConfig/sssdoptions.py:374
+#: src/config/SSSDConfig/sssdoptions.py:373
 msgid "Specify the sasl authorization id to use"
 msgstr "指定要使用的 sasl 認證 id"
 
-#: src/config/SSSDConfig/sssdoptions.py:375
+#: src/config/SSSDConfig/sssdoptions.py:374
 msgid "Specify the sasl authorization realm to use"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:376
+#: src/config/SSSDConfig/sssdoptions.py:375
 msgid "Specify the minimal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:377
+#: src/config/SSSDConfig/sssdoptions.py:376
 msgid "Specify the maximal SSF for LDAP sasl authorization"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:378
+#: src/config/SSSDConfig/sssdoptions.py:377
 msgid "Kerberos service keytab"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:379
+#: src/config/SSSDConfig/sssdoptions.py:378
 msgid "Use Kerberos auth for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:380
+#: src/config/SSSDConfig/sssdoptions.py:379
 msgid "Follow LDAP referrals"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:381
+#: src/config/SSSDConfig/sssdoptions.py:380
 msgid "Lifetime of TGT for LDAP connection"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:382
+#: src/config/SSSDConfig/sssdoptions.py:381
 msgid "How to dereference aliases"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:383
+#: src/config/SSSDConfig/sssdoptions.py:382
 msgid "Service name for DNS service lookups"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:384
+#: src/config/SSSDConfig/sssdoptions.py:383
 msgid "The number of records to retrieve in a single LDAP query"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:385
+#: src/config/SSSDConfig/sssdoptions.py:384
 msgid "The number of members that must be missing to trigger a full deref"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:386
+#: src/config/SSSDConfig/sssdoptions.py:385
 msgid "Ignore unreadable LDAP references"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:387
+#: src/config/SSSDConfig/sssdoptions.py:386
 msgid ""
 "Whether the LDAP library should perform a reverse lookup to canonicalize the "
 "host name during a SASL bind"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:389
+#: src/config/SSSDConfig/sssdoptions.py:388
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:392
+#: src/config/SSSDConfig/sssdoptions.py:391
 msgid "entryUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:393
+#: src/config/SSSDConfig/sssdoptions.py:392
 msgid "lastUSN attribute"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:395
+#: src/config/SSSDConfig/sssdoptions.py:394
 msgid "How long to retain a connection to the LDAP server before disconnecting"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:398
+#: src/config/SSSDConfig/sssdoptions.py:397
 msgid "Disable the LDAP paging control"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:399
+#: src/config/SSSDConfig/sssdoptions.py:398
 msgid "Disable Active Directory range retrieval"
 msgstr ""
 
-#: src/config/SSSDConfig/sssdoptions.py:400
+#: src/config/SSSDConfig/sssdoptions.py:399
 msgid "Use the ppolicy extension"
 msgstr ""
 
+#: src/config/SSSDConfig/sssdoptions.py:400
+msgid ""
+"Force a password change when remaining grace logins reach or go below this "
+"threshold"
+msgstr ""
+
 #: src/config/SSSDConfig/sssdoptions.py:403
 msgid "Length of time to wait for a search request"
 msgstr "搜尋請求的等候時間長度"
@@ -1846,32 +1848,32 @@ msgstr ""
 msgid "Path of group file sources."
 msgstr ""
 
-#: src/monitor/monitor.c:819
+#: src/monitor/monitor.c:722
 msgid "Config operation failed\n"
 msgstr ""
 
-#: src/monitor/monitor.c:830
+#: src/monitor/monitor.c:733
 msgid "'"
 msgstr ""
 
-#: src/monitor/monitor.c:845
+#: src/monitor/monitor.c:748
 #, c-format
 msgid "Unsupported value '%s' of config option '%s'! Only 'root' or '"
 msgstr ""
 
-#: src/monitor/monitor.c:1975
+#: src/monitor/monitor.c:1827
 msgid "Become a daemon (default)"
 msgstr "作為幕後程式 (預設)"
 
-#: src/monitor/monitor.c:1977
+#: src/monitor/monitor.c:1829
 msgid "Run interactive (not a daemon)"
 msgstr "以互動方式執行 (非幕後程式)"
 
-#: src/monitor/monitor.c:1979
+#: src/monitor/monitor.c:1831
 msgid "Print version number and exit"
 msgstr ""
 
-#: src/monitor/monitor.c:1990
+#: src/monitor/monitor.c:1842
 #, c-format
 msgid ""
 "\n"
@@ -1879,97 +1881,97 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2012
+#: src/monitor/monitor.c:1864
 msgid "Option -i|--interactive is not allowed together with -D|--daemon\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2054
+#: src/monitor/monitor.c:1906
 msgid "Failed to get initial capabilities\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2065
+#: src/monitor/monitor.c:1917
 msgid "Non-root service user support isn't built. Can't run under %"
 msgstr ""
 
-#: src/monitor/monitor.c:2082
+#: src/monitor/monitor.c:1934
 #, c-format
 msgid "Can't read config: '%s'\n"
 msgstr ""
 
-#: src/monitor/monitor.c:2101
+#: src/monitor/monitor.c:1953
 #, c-format
 msgid "Failed to boostrap SSSD 'monitor' process: %s"
 msgstr ""
 
-#: src/monitor/monitor.c:2194
+#: src/monitor/monitor.c:2050
 msgid "Out of memory\n"
 msgstr "記憶體耗盡\n"
 
-#: src/providers/krb5/krb5_child.c:4154 src/providers/ldap/ldap_child.c:994
+#: src/providers/krb5/krb5_child.c:4145 src/providers/ldap/ldap_child.c:994
 msgid "Allow core dumps"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4156 src/providers/ldap/ldap_child.c:996
+#: src/providers/krb5/krb5_child.c:4147 src/providers/ldap/ldap_child.c:996
 msgid "An open file descriptor for the debug logs"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4159
+#: src/providers/krb5/krb5_child.c:4150
 msgid "The user to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4161
+#: src/providers/krb5/krb5_child.c:4152
 msgid "The group to create FAST ccache as"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4163
+#: src/providers/krb5/krb5_child.c:4154
 msgid "Use anonymous PKINIT to request FAST armor ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4165
+#: src/providers/krb5/krb5_child.c:4156
 msgid "Kerberos realm to use"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4167
+#: src/providers/krb5/krb5_child.c:4158
 msgid "Requested lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4169
+#: src/providers/krb5/krb5_child.c:4160
 msgid "Requested renewable lifetime of the ticket"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4171
+#: src/providers/krb5/krb5_child.c:4162
 msgid "FAST options ('never', 'try', 'demand')"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4174
+#: src/providers/krb5/krb5_child.c:4165
 msgid "Specifies the server principal to use for FAST"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4176
+#: src/providers/krb5/krb5_child.c:4167
 msgid "Requests canonicalization of the principal name"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4178
+#: src/providers/krb5/krb5_child.c:4169
 msgid "Use custom version of krb5_get_init_creds_password"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4180
+#: src/providers/krb5/krb5_child.c:4171
 msgid "Tevent chain ID used for logging purposes"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4182
+#: src/providers/krb5/krb5_child.c:4173
 msgid "Check PAC flags"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4226 src/providers/ldap/ldap_child.c:1022
+#: src/providers/krb5/krb5_child.c:4217 src/providers/ldap/ldap_child.c:1022
 msgid "talloc_asprintf failed.\n"
 msgstr ""
 
-#: src/providers/krb5/krb5_child.c:4236 src/providers/ldap/ldap_child.c:1031
+#: src/providers/krb5/krb5_child.c:4227 src/providers/ldap/ldap_child.c:1031
 msgid "set_debug_file_from_fd failed.\n"
 msgstr ""
 
-#: src/providers/data_provider_be.c:772
+#: src/providers/data_provider_be.c:794
 msgid "Domain of the information provider (mandatory)"
 msgstr ""
 
@@ -2001,140 +2003,140 @@ msgstr ""
 msgid "Unexpected error while looking for an error description"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:69
+#: src/sss_client/pam_sss.c:70
 msgid "Permission denied. "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:70 src/sss_client/pam_sss.c:838
-#: src/sss_client/pam_sss.c:849
+#: src/sss_client/pam_sss.c:71 src/sss_client/pam_sss.c:839
+#: src/sss_client/pam_sss.c:850
 msgid "Server message: "
 msgstr "伺服器訊息："
 
-#: src/sss_client/pam_sss.c:71
+#: src/sss_client/pam_sss.c:72
 msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:72
+#: src/sss_client/pam_sss.c:73
 msgid "Enter PIN:"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:315
+#: src/sss_client/pam_sss.c:316
 msgid "Passwords do not match"
 msgstr "密碼不相符"
 
-#: src/sss_client/pam_sss.c:503
+#: src/sss_client/pam_sss.c:504
 msgid "Password reset by root is not supported."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:544
+#: src/sss_client/pam_sss.c:545
 msgid "Authenticated with cached credentials"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:545
+#: src/sss_client/pam_sss.c:546
 msgid ", your cached password will expire at: "
 msgstr "，您快取的密碼將在此刻過期："
 
-#: src/sss_client/pam_sss.c:575
+#: src/sss_client/pam_sss.c:576
 #, c-format
 msgid "Your password has expired. You have %1$d grace login(s) remaining."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:625
+#: src/sss_client/pam_sss.c:626
 #, c-format
 msgid "Your password will expire in %1$d %2$s."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:628
+#: src/sss_client/pam_sss.c:629
 #, fuzzy, c-format
 msgid "Your password has expired."
 msgstr "，您快取的密碼將在此刻過期："
 
-#: src/sss_client/pam_sss.c:679
+#: src/sss_client/pam_sss.c:680
 msgid "Authentication is denied until: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:700
+#: src/sss_client/pam_sss.c:701
 msgid "System is offline, password change not possible"
 msgstr "系統已離線，不可能作密碼變更"
 
-#: src/sss_client/pam_sss.c:715
+#: src/sss_client/pam_sss.c:716
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:730
+#: src/sss_client/pam_sss.c:731
 msgid "PIN locked"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:745
+#: src/sss_client/pam_sss.c:746
 msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
+#: src/sss_client/pam_sss.c:836 src/sss_client/pam_sss.c:849
 msgid "Password change failed. "
 msgstr "密碼變更失敗。"
 
-#: src/sss_client/pam_sss.c:1819
+#: src/sss_client/pam_sss.c:1838
 #, c-format
 msgid "Authenticate at %1$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:1822
+#: src/sss_client/pam_sss.c:1841
 #, c-format
 msgid "Authenticate with PIN %1$s at %2$s and press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2181
+#: src/sss_client/pam_sss.c:2201
 msgid "Please (re)insert (different) Smartcard"
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2380
+#: src/sss_client/pam_sss.c:2402
 msgid "New Password: "
 msgstr "新密碼："
 
-#: src/sss_client/pam_sss.c:2381
+#: src/sss_client/pam_sss.c:2403
 msgid "Reenter new Password: "
 msgstr "再次輸入新密碼："
 
-#: src/sss_client/pam_sss.c:2567 src/sss_client/pam_sss.c:2570
+#: src/sss_client/pam_sss.c:2594 src/sss_client/pam_sss.c:2597
 msgid "First Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2568 src/sss_client/pam_sss.c:2740
+#: src/sss_client/pam_sss.c:2595 src/sss_client/pam_sss.c:2768
 msgid "Second Factor (optional): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2571 src/sss_client/pam_sss.c:2743
+#: src/sss_client/pam_sss.c:2598 src/sss_client/pam_sss.c:2772
 msgid "Second Factor: "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2575
+#: src/sss_client/pam_sss.c:2602
 msgid "Insert your passkey device, then press ENTER."
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2579 src/sss_client/pam_sss.c:2587
+#: src/sss_client/pam_sss.c:2606 src/sss_client/pam_sss.c:2614
 msgid "Password: "
 msgstr "密碼："
 
-#: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
+#: src/sss_client/pam_sss.c:2767 src/sss_client/pam_sss.c:2771
 msgid "First Factor (Current Password): "
 msgstr ""
 
-#: src/sss_client/pam_sss.c:2762
+#: src/sss_client/pam_sss.c:2791
 msgid "Current Password: "
 msgstr "目前的密碼："
 
-#: src/sss_client/pam_sss.c:3118
+#: src/sss_client/pam_sss.c:3147
 msgid "Password expired. Change your password now."
 msgstr "密碼已過期。請立刻變更您的密碼。"
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
-#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:732
+#: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:205 src/tools/sss_cache.c:707
 msgid "The debug level to run with"
 msgstr ""
 
@@ -2143,7 +2145,7 @@ msgstr ""
 msgid "The SSSD domain to use"
 msgstr ""
 
-#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:778
+#: src/sss_client/ssh/sss_ssh_authorizedkeys.c:57 src/tools/sss_cache.c:753
 msgid "Error setting the locale\n"
 msgstr "設定區域設置時發生錯誤\n"
 
@@ -2205,102 +2207,106 @@ msgstr ""
 msgid "sss_ssh_knownhostsproxy: Could not resolve hostname %s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:245
+#: src/tools/sss_cache.c:229
 msgid "No cache object matched the specified search\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:536
+#: src/tools/sss_cache.c:520
 #, c-format
 msgid "Couldn't invalidate %1$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:543
+#: src/tools/sss_cache.c:527
 #, c-format
 msgid "Couldn't invalidate %1$s %2$s\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:734
+#: src/tools/sss_cache.c:653
+msgid "Can't find configuration db, was SSSD configured and run?\n"
+msgstr ""
+
+#: src/tools/sss_cache.c:709
 msgid "Invalidate all cached entries"
 msgstr ""
 
-#: src/tools/sss_cache.c:736
+#: src/tools/sss_cache.c:711
 msgid "Invalidate particular user"
 msgstr ""
 
-#: src/tools/sss_cache.c:738
+#: src/tools/sss_cache.c:713
 msgid "Invalidate all users"
 msgstr ""
 
-#: src/tools/sss_cache.c:740
+#: src/tools/sss_cache.c:715
 msgid "Invalidate particular group"
 msgstr ""
 
-#: src/tools/sss_cache.c:742
+#: src/tools/sss_cache.c:717
 msgid "Invalidate all groups"
 msgstr ""
 
-#: src/tools/sss_cache.c:744
+#: src/tools/sss_cache.c:719
 msgid "Invalidate particular netgroup"
 msgstr ""
 
-#: src/tools/sss_cache.c:746
+#: src/tools/sss_cache.c:721
 msgid "Invalidate all netgroups"
 msgstr ""
 
-#: src/tools/sss_cache.c:748
+#: src/tools/sss_cache.c:723
 msgid "Invalidate particular service"
 msgstr ""
 
-#: src/tools/sss_cache.c:750
+#: src/tools/sss_cache.c:725
 msgid "Invalidate all services"
 msgstr ""
 
-#: src/tools/sss_cache.c:753
+#: src/tools/sss_cache.c:728
 msgid "Invalidate particular autofs map"
 msgstr ""
 
-#: src/tools/sss_cache.c:755
+#: src/tools/sss_cache.c:730
 msgid "Invalidate all autofs maps"
 msgstr ""
 
-#: src/tools/sss_cache.c:759
+#: src/tools/sss_cache.c:734
 msgid "Invalidate particular SSH host"
 msgstr ""
 
-#: src/tools/sss_cache.c:761
+#: src/tools/sss_cache.c:736
 msgid "Invalidate all SSH hosts"
 msgstr ""
 
-#: src/tools/sss_cache.c:765
+#: src/tools/sss_cache.c:740
 msgid "Invalidate particular sudo rule"
 msgstr ""
 
-#: src/tools/sss_cache.c:767
+#: src/tools/sss_cache.c:742
 msgid "Invalidate all cached sudo rules"
 msgstr ""
 
-#: src/tools/sss_cache.c:770
+#: src/tools/sss_cache.c:745
 msgid "Only invalidate entries from a particular domain"
 msgstr ""
 
-#: src/tools/sss_cache.c:824
+#: src/tools/sss_cache.c:799
 msgid ""
 "Unexpected argument(s) provided, options that invalidate a single object "
 "only accept a single provided argument.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:834
+#: src/tools/sss_cache.c:809
 msgid "Please select at least one object to invalidate\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:917
+#: src/tools/sss_cache.c:892
 #, c-format
 msgid ""
 "Could not open domain %1$s. If the domain is a subdomain (trusted domain), "
 "use fully qualified name instead of --domain/-d parameter.\n"
 msgstr ""
 
-#: src/tools/sss_cache.c:922
+#: src/tools/sss_cache.c:897
 msgid "Could not open available domains\n"
 msgstr ""
 
@@ -2334,163 +2340,163 @@ msgstr ""
 msgid "Invalid input, please provide either '%s' or '%s'.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:146 src/tools/sssctl/sssctl.c:156
+#: src/tools/sssctl/sssctl.c:151 src/tools/sssctl/sssctl.c:161
 msgid "Error while executing external command\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:160
+#: src/tools/sssctl/sssctl.c:165
 #, c-format
 msgid "Error while executing external command '%s'\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:163
+#: src/tools/sssctl/sssctl.c:168
 #, c-format
 msgid "Command '%s' failed with [%d]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:210
+#: src/tools/sssctl/sssctl.c:215
 msgid "SSSD needs to be running. Start SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:249
+#: src/tools/sssctl/sssctl.c:254
 msgid "SSSD must not be running. Stop SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:285
+#: src/tools/sssctl/sssctl.c:290
 msgid "SSSD needs to be restarted. Restart SSSD now?"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:317
+#: src/tools/sssctl/sssctl.c:322
 msgid "SSSD Status:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:318
+#: src/tools/sssctl/sssctl.c:323
 msgid "List available domains"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:319
+#: src/tools/sssctl/sssctl.c:324
 msgid "Print information about domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:320
+#: src/tools/sssctl/sssctl.c:325
 msgid "Print information about a user and check authentication"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:321
+#: src/tools/sssctl/sssctl.c:326
 msgid "Generate access report for a domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:322
+#: src/tools/sssctl/sssctl.c:327
 msgid "Information about cached content:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:323
+#: src/tools/sssctl/sssctl.c:328
 #, fuzzy
 msgid "Information about cached user"
 msgstr "無法取得關於這位使用者的資訊\n"
 
-#: src/tools/sssctl/sssctl.c:324
+#: src/tools/sssctl/sssctl.c:329
 msgid "Information about cached group"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:325
+#: src/tools/sssctl/sssctl.c:330
 msgid "Information about cached netgroup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:326
+#: src/tools/sssctl/sssctl.c:331
 msgid "Local data tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:327
+#: src/tools/sssctl/sssctl.c:332
 msgid "Backup local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:328
+#: src/tools/sssctl/sssctl.c:333
 msgid "Restore local data from backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:329
+#: src/tools/sssctl/sssctl.c:334
 msgid "Backup local data and remove cached content"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:330
+#: src/tools/sssctl/sssctl.c:335
 msgid "Invalidate cached objects"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:331
+#: src/tools/sssctl/sssctl.c:336
 msgid "Manage cache indexes"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:332
+#: src/tools/sssctl/sssctl.c:337
 msgid "Log files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:333
+#: src/tools/sssctl/sssctl.c:338
 msgid "Remove existing SSSD log files"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:334
+#: src/tools/sssctl/sssctl.c:339
 msgid "Archive SSSD log files in tarball"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:335
+#: src/tools/sssctl/sssctl.c:340
 msgid "Change or print information about SSSD debug level"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:336
+#: src/tools/sssctl/sssctl.c:341
 msgid "Analyze logged data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:337
+#: src/tools/sssctl/sssctl.c:342
 msgid "Configuration files tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:338
+#: src/tools/sssctl/sssctl.c:343
 msgid "Perform static analysis of SSSD configuration"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:339
+#: src/tools/sssctl/sssctl.c:344
 msgid "Certificate related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:340
+#: src/tools/sssctl/sssctl.c:345
 msgid "Print information about the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:341
+#: src/tools/sssctl/sssctl.c:346
 msgid "Show users mapped to the certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:342
+#: src/tools/sssctl/sssctl.c:347
 msgid "Check mapping and matching rule with a certificate"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:343
+#: src/tools/sssctl/sssctl.c:348
 msgid "GPOs related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:344
+#: src/tools/sssctl/sssctl.c:349
 #, fuzzy
 msgid "Information about cached GPO"
 msgstr "無法取得關於這位使用者的資訊\n"
 
-#: src/tools/sssctl/sssctl.c:345
+#: src/tools/sssctl/sssctl.c:350
 msgid "Enumerate cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:346
+#: src/tools/sssctl/sssctl.c:351
 msgid "Remove cached GPO"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:347
+#: src/tools/sssctl/sssctl.c:352
 msgid "Remove all cached GPOs"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:349
+#: src/tools/sssctl/sssctl.c:354
 msgid "Passkey related tools:"
 msgstr ""
 
-#: src/tools/sssctl/sssctl.c:350
+#: src/tools/sssctl/sssctl.c:355
 msgid "Perform passkey registration"
 msgstr ""
 
@@ -2545,7 +2551,7 @@ msgstr ""
 msgid "Error: Unable to get object [%d]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:941
+#: src/tools/sssctl/sssctl_cache.c:582 src/tools/sssctl/sssctl_cache.c:937
 #, c-format
 msgid "%s: Unable to read value [%d]: %s\n"
 msgstr ""
@@ -2559,211 +2565,211 @@ msgstr ""
 msgid "Unable to parse name %s.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:652 src/tools/sssctl/sssctl_cache.c:700
+#: src/tools/sssctl/sssctl_cache.c:651 src/tools/sssctl/sssctl_cache.c:698
 msgid "Search by SID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:653
+#: src/tools/sssctl/sssctl_cache.c:652
 msgid "Search by user ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:662
+#: src/tools/sssctl/sssctl_cache.c:661
 msgid "Initgroups expiration time"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:701
+#: src/tools/sssctl/sssctl_cache.c:699
 msgid "Search by group ID"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:792 src/tools/sssctl/sssctl_cache.c:1142
+#: src/tools/sssctl/sssctl_cache.c:788 src/tools/sssctl/sssctl_cache.c:1136
 msgid "Search by GPO guid"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:799 src/tools/sssctl/sssctl_cache.c:1159
+#: src/tools/sssctl/sssctl_cache.c:795 src/tools/sssctl/sssctl_cache.c:1153
 #, c-format
 msgid "Failed to parse command line: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:804 src/tools/sssctl/sssctl_cache.c:1164
+#: src/tools/sssctl/sssctl_cache.c:800 src/tools/sssctl/sssctl_cache.c:1158
 #, c-format
 msgid "%s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:817
+#: src/tools/sssctl/sssctl_cache.c:813
 #, c-format
 msgid "Failed to print object: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:849 src/tools/sssctl/sssctl_cache.c:932
-#: src/tools/sssctl/sssctl_cache.c:965 src/tools/sssctl/sssctl_cache.c:971
-#: src/tools/sssctl/sssctl_cache.c:1025 src/tools/sssctl/sssctl_cache.c:1049
-#: src/tools/sssctl/sssctl_cache.c:1100 src/tools/sssctl/sssctl_cache.c:1210
-#: src/tools/sssctl/sssctl_cache.c:1246 src/tools/sssctl/sssctl_cache.c:1252
-#: src/tools/sssctl/sssctl_cache.c:1261
+#: src/tools/sssctl/sssctl_cache.c:845 src/tools/sssctl/sssctl_cache.c:928
+#: src/tools/sssctl/sssctl_cache.c:960 src/tools/sssctl/sssctl_cache.c:966
+#: src/tools/sssctl/sssctl_cache.c:1020 src/tools/sssctl/sssctl_cache.c:1044
+#: src/tools/sssctl/sssctl_cache.c:1095 src/tools/sssctl/sssctl_cache.c:1204
+#: src/tools/sssctl/sssctl_cache.c:1239 src/tools/sssctl/sssctl_cache.c:1245
+#: src/tools/sssctl/sssctl_cache.c:1254
 msgid "talloc failed\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:855
+#: src/tools/sssctl/sssctl_cache.c:851
 msgid "Unable to get attribute list!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:862
+#: src/tools/sssctl/sssctl_cache.c:858
 msgid "Unable to create filter\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:875
+#: src/tools/sssctl/sssctl_cache.c:871
 #, c-format
 msgid "%s [%s]:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:880
+#: src/tools/sssctl/sssctl_cache.c:876
 msgid "Unable to get GPOs base DN\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:890
+#: src/tools/sssctl/sssctl_cache.c:886
 #, c-format
 msgid "Unable to search sysdb: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:896
+#: src/tools/sssctl/sssctl_cache.c:892
 #, c-format
 msgid "Unable to convert message to sysdb attrs: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:945
+#: src/tools/sssctl/sssctl_cache.c:941
 #, c-format
 msgid "\t%s: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:947 src/tools/sssctl/sssctl_logs.c:51
+#: src/tools/sssctl/sssctl_cache.c:943 src/tools/sssctl/sssctl_logs.c:50
 msgid "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1031
+#: src/tools/sssctl/sssctl_cache.c:1026
 msgid "Could not find GUID attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1038
+#: src/tools/sssctl/sssctl_cache.c:1033
 msgid "Could not find description attribute from GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1062
+#: src/tools/sssctl/sssctl_cache.c:1057
 msgid "Could not delete GPO entry from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1068
+#: src/tools/sssctl/sssctl_cache.c:1063
 #, c-format
 msgid ""
 "The GPO path was not yet stored in cache. Please remove files manually from "
 "[%s]\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1077 src/tools/sssctl/sssctl_cache.c:1083
+#: src/tools/sssctl/sssctl_cache.c:1072 src/tools/sssctl/sssctl_cache.c:1078
 #, c-format
 msgid "Could not determine real path for [%s]: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1088
+#: src/tools/sssctl/sssctl_cache.c:1083
 #, c-format
 msgid "The cached GPO path [%s] is not under [%s], ignoring.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1113
+#: src/tools/sssctl/sssctl_cache.c:1108
 #, c-format
 msgid "Unable to remove downloaded GPO files: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1181
+#: src/tools/sssctl/sssctl_cache.c:1175
 #, c-format
 msgid "Failed to fetch cache entry: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1186
+#: src/tools/sssctl/sssctl_cache.c:1180
 msgid "Could not determine object domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1216
+#: src/tools/sssctl/sssctl_cache.c:1210
 msgid "Could not find GUID attribute in GPO entry\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1222
+#: src/tools/sssctl/sssctl_cache.c:1216
 #, c-format
 msgid "Failed to delete GPO: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cache.c:1226
+#: src/tools/sssctl/sssctl_cache.c:1220
 #, c-format
 msgid "%s removed from cache\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:51 src/tools/sssctl/sssctl_cert.c:110
-#: src/tools/sssctl/sssctl_cert.c:217
+#: src/tools/sssctl/sssctl_cert.c:50 src/tools/sssctl/sssctl_cert.c:108
+#: src/tools/sssctl/sssctl_cert.c:214
 msgid "Show debug information"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:57 src/tools/sssctl/sssctl_cert.c:116
-#: src/tools/sssctl/sssctl_cert.c:223
+#: src/tools/sssctl/sssctl_cert.c:56 src/tools/sssctl/sssctl_cert.c:114
+#: src/tools/sssctl/sssctl_cert.c:220
 msgid "Specify base64 encoded certificate."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:140 src/tools/sssctl/sssctl_domains.c:105
-#: src/tools/sssctl/sssctl_domains.c:368
+#: src/tools/sssctl/sssctl_cert.c:138 src/tools/sssctl/sssctl_domains.c:104
+#: src/tools/sssctl/sssctl_domains.c:366
 #: src/tools/sssctl/sssctl_user_checks.c:99
 msgid "Unable to connect to system bus!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:166
+#: src/tools/sssctl/sssctl_cert.c:164
 msgid " - no mapped users found -"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:215
+#: src/tools/sssctl/sssctl_cert.c:212
 msgid "Mapping rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:216
+#: src/tools/sssctl/sssctl_cert.c:213
 msgid "Matching rule"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:226
+#: src/tools/sssctl/sssctl_cert.c:223
 msgid "Unable to parse command arguments\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:232 src/tools/sssctl/sssctl_domains.c:356
+#: src/tools/sssctl/sssctl_cert.c:229 src/tools/sssctl/sssctl_domains.c:354
 msgid "Out of memory!\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:241
+#: src/tools/sssctl/sssctl_cert.c:238
 msgid "Failed to setup certmap context.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:247
+#: src/tools/sssctl/sssctl_cert.c:244
 #, c-format
 msgid "Failed to add mapping and matching rules with error [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:254
+#: src/tools/sssctl/sssctl_cert.c:251
 msgid "Failed to decode base64 string.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:262
+#: src/tools/sssctl/sssctl_cert.c:259
 msgid "Certificate matches rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:265
+#: src/tools/sssctl/sssctl_cert.c:262
 msgid "Certificate does not match rule.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:268
+#: src/tools/sssctl/sssctl_cert.c:265
 #, c-format
 msgid "Error during certificate matching [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:275
+#: src/tools/sssctl/sssctl_cert.c:272
 #, c-format
 msgid "Failed to generate mapping filter [%d][%s].\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_cert.c:279
+#: src/tools/sssctl/sssctl_cert.c:276
 #, c-format
 msgid ""
 "Mapping filter:\n"
@@ -2772,42 +2778,42 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:76
+#: src/tools/sssctl/sssctl_config.c:75
 msgid ""
 "Specify a non-default snippet dir (The default is to look in the same place "
 "where the main config file is located. For example if the config is set to "
 "\"/my/path/sssd.conf\", the snippet dir \"/my/path/conf.d\" is used)"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:115
+#: src/tools/sssctl/sssctl_config.c:114
 #, c-format
 msgid "File %1$s does not exist.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:116
+#: src/tools/sssctl/sssctl_config.c:115
 msgid "There is no configuration.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:121
+#: src/tools/sssctl/sssctl_config.c:120
 #, c-format
 msgid "Failed to read '%s': %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:130
+#: src/tools/sssctl/sssctl_config.c:129
 msgid "Failed to run validators"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:134
+#: src/tools/sssctl/sssctl_config.c:133
 #, c-format
 msgid "Issues identified by validators: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:145
+#: src/tools/sssctl/sssctl_config.c:144
 #, c-format
 msgid "Messages generated during configuration merging: %zu\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_config.c:158
+#: src/tools/sssctl/sssctl_config.c:157
 #, c-format
 msgid "Used configuration snippet files: %zu\n"
 msgstr ""
@@ -2829,282 +2835,282 @@ msgstr ""
 msgid "Unable to export group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:136 src/tools/sssctl/sssctl_data.c:219
+#: src/tools/sssctl/sssctl_data.c:135 src/tools/sssctl/sssctl_data.c:216
 msgid "Override existing backup"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:166
+#: src/tools/sssctl/sssctl_data.c:165
 msgid "Unable to import user overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:175
+#: src/tools/sssctl/sssctl_data.c:174
 msgid "Unable to import group overrides\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:196 src/tools/sssctl/sssctl_domains.c:82
-#: src/tools/sssctl/sssctl_domains.c:328
+#: src/tools/sssctl/sssctl_data.c:194 src/tools/sssctl/sssctl_domains.c:81
+#: src/tools/sssctl/sssctl_domains.c:326
 msgid "Start SSSD if it is not running"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:197
+#: src/tools/sssctl/sssctl_data.c:195
 msgid "Restart SSSD after data import"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:220
+#: src/tools/sssctl/sssctl_data.c:217
 msgid "Create clean cache files and import local data"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:221
+#: src/tools/sssctl/sssctl_data.c:218
 msgid "Stop SSSD before removing the cache"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:222
+#: src/tools/sssctl/sssctl_data.c:219
 msgid "Start SSSD when the cache is removed"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:237
+#: src/tools/sssctl/sssctl_data.c:234
 msgid "Creating backup of local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:240
+#: src/tools/sssctl/sssctl_data.c:237
 msgid "Unable to create backup of local data, can not remove the cache.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:245
+#: src/tools/sssctl/sssctl_data.c:242
 msgid "Removing cache files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:248
+#: src/tools/sssctl/sssctl_data.c:245
 msgid "Unable to remove cache files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:253
+#: src/tools/sssctl/sssctl_data.c:250
 msgid "Restoring local data...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:381
+#: src/tools/sssctl/sssctl_data.c:377
 #, c-format
 msgid "Creating cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:383
+#: src/tools/sssctl/sssctl_data.c:379
 #, c-format
 msgid "Deleting cache index for domain %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:385
+#: src/tools/sssctl/sssctl_data.c:381
 #, c-format
 msgid "Indexes for domain %1$s:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:405
+#: src/tools/sssctl/sssctl_data.c:401
 #, c-format
 msgid "  Attribute: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 msgid "Target a specific domain"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:433 src/tools/sssctl/sssctl_logs.c:529
+#: src/tools/sssctl/sssctl_data.c:428 src/tools/sssctl/sssctl_logs.c:525
 #, fuzzy
 msgid "domain"
 msgstr "IPA 網域"
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "Attribute to index"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:435
+#: src/tools/sssctl/sssctl_data.c:430
 msgid "attribute"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:448
+#: src/tools/sssctl/sssctl_data.c:443
 #, fuzzy
 msgid "Action not provided\n"
 msgstr "認證提供者"
 
-#: src/tools/sssctl/sssctl_data.c:461
+#: src/tools/sssctl/sssctl_data.c:456
 #, c-format
 msgid ""
 "Unknown action: %1$s\n"
 "Valid actions are \"%2$s\", \"%3$s and \"%4$s\"\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:469
+#: src/tools/sssctl/sssctl_data.c:464
 msgid "Attribute (-a) not provided\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:477
+#: src/tools/sssctl/sssctl_data.c:472
 #, c-format
 msgid "Attribute %1$s not indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:480
+#: src/tools/sssctl/sssctl_data.c:475
 #, c-format
 msgid "Attribute %1$s already indexed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:483
+#: src/tools/sssctl/sssctl_data.c:478
 #, c-format
 msgid "Index operation failed: %1$s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_data.c:488
+#: src/tools/sssctl/sssctl_data.c:483
 msgid "Don't forget to also update the indexes on the remote providers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:83
+#: src/tools/sssctl/sssctl_domains.c:82
 msgid "Show domain list including primary or trusted domain type"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Online"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 msgid "Offline"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:167
+#: src/tools/sssctl/sssctl_domains.c:166
 #, c-format
 msgid "Online status: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:213
+#: src/tools/sssctl/sssctl_domains.c:212
 msgid "This domain has no active servers.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:218
+#: src/tools/sssctl/sssctl_domains.c:217
 msgid "Active servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:230
+#: src/tools/sssctl/sssctl_domains.c:229
 msgid "not connected"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:267
+#: src/tools/sssctl/sssctl_domains.c:266
 msgid "No servers discovered.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:273
+#: src/tools/sssctl/sssctl_domains.c:272
 #, c-format
 msgid "Discovered %s servers:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:285
+#: src/tools/sssctl/sssctl_domains.c:284
 msgid "None so far.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:325
+#: src/tools/sssctl/sssctl_domains.c:323
 msgid "Show online status"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:326
+#: src/tools/sssctl/sssctl_domains.c:324
 msgid "Show information about active server"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:327
+#: src/tools/sssctl/sssctl_domains.c:325
 msgid "Show list of discovered servers"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:333
+#: src/tools/sssctl/sssctl_domains.c:331
 msgid "Specify domain name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:376 src/tools/sssctl/sssctl_domains.c:386
+#: src/tools/sssctl/sssctl_domains.c:374 src/tools/sssctl/sssctl_domains.c:384
 msgid "Unable to get online status\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_domains.c:396
+#: src/tools/sssctl/sssctl_domains.c:394
 msgid "Unable to get server list\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:215
+#: src/tools/sssctl/sssctl_logs.c:214
 msgid "SSSD is not running.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:232
+#: src/tools/sssctl/sssctl_logs.c:231
 #, c-format
 msgid "%1$-25s %2$#.4x\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:236
+#: src/tools/sssctl/sssctl_logs.c:235
 #, c-format
 msgid "%1$-25s Unknown domain\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:238
+#: src/tools/sssctl/sssctl_logs.c:237
 #, c-format
 msgid "%1$-25s Unreachable service\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:431
+#: src/tools/sssctl/sssctl_logs.c:429
 msgid "Delete log files instead of truncating"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:442
+#: src/tools/sssctl/sssctl_logs.c:440
 msgid "Deleting log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:445
+#: src/tools/sssctl/sssctl_logs.c:443
 msgid "Unable to remove log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:462
+#: src/tools/sssctl/sssctl_logs.c:460
 msgid "Truncating log files...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:466
+#: src/tools/sssctl/sssctl_logs.c:464
 msgid "Unable to truncate log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:501
+#: src/tools/sssctl/sssctl_logs.c:498
 #, c-format
 msgid "Archiving log files into %s...\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:505
+#: src/tools/sssctl/sssctl_logs.c:502
 msgid "Unable to archive log files\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:530
+#: src/tools/sssctl/sssctl_logs.c:526
 msgid "Target the SSSD service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:531
+#: src/tools/sssctl/sssctl_logs.c:527
 msgid "Target the NSS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:532
+#: src/tools/sssctl/sssctl_logs.c:528
 msgid "Target the PAM service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:533
+#: src/tools/sssctl/sssctl_logs.c:529
 msgid "Target the SUDO service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:534
+#: src/tools/sssctl/sssctl_logs.c:530
 msgid "Target the AUTOFS service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:535
+#: src/tools/sssctl/sssctl_logs.c:531
 msgid "Target the SSH service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:536
+#: src/tools/sssctl/sssctl_logs.c:532
 msgid "Target the PAC service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:537
+#: src/tools/sssctl/sssctl_logs.c:533
 msgid "Target the IFP service"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:552
+#: src/tools/sssctl/sssctl_logs.c:548
 msgid "Specify debug level you want to set"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_logs.c:600
+#: src/tools/sssctl/sssctl_logs.c:593
 msgid "ERROR: Tevent chain ID support missing, log analyzer is unsupported.\n"
 msgstr ""
 
@@ -3167,19 +3173,19 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:236
+#: src/tools/sssctl/sssctl_user_checks.c:235
 msgid "PAM action [auth|acct|setc|chau|open|clos], default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:239
+#: src/tools/sssctl/sssctl_user_checks.c:238
 msgid "PAM service, default: "
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:244
+#: src/tools/sssctl/sssctl_user_checks.c:243
 msgid "Specify user name."
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:251
+#: src/tools/sssctl/sssctl_user_checks.c:250
 #, c-format
 msgid ""
 "user: %s\n"
@@ -3188,121 +3194,121 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:256
+#: src/tools/sssctl/sssctl_user_checks.c:255
 #, c-format
 msgid "User name lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:261
+#: src/tools/sssctl/sssctl_user_checks.c:260
 #, c-format
 msgid "InfoPipe User lookup with [%s] failed.\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:267
+#: src/tools/sssctl/sssctl_user_checks.c:266
 #, c-format
 msgid "pam_start failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:273
+#: src/tools/sssctl/sssctl_user_checks.c:272
 msgid ""
 "testing pam_authenticate\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:277
+#: src/tools/sssctl/sssctl_user_checks.c:276
 #, c-format
 msgid "pam_get_item failed: %s\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:280
+#: src/tools/sssctl/sssctl_user_checks.c:279
 #, c-format
 msgid ""
 "pam_authenticate for user [%s]: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:283
+#: src/tools/sssctl/sssctl_user_checks.c:282
 msgid ""
 "testing pam_chauthtok\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:285
+#: src/tools/sssctl/sssctl_user_checks.c:284
 #, c-format
 msgid ""
 "pam_chauthtok: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:287
+#: src/tools/sssctl/sssctl_user_checks.c:286
 msgid ""
 "testing pam_acct_mgmt\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:289
+#: src/tools/sssctl/sssctl_user_checks.c:288
 #, c-format
 msgid ""
 "pam_acct_mgmt: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:291
+#: src/tools/sssctl/sssctl_user_checks.c:290
 msgid ""
 "testing pam_setcred\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:293
+#: src/tools/sssctl/sssctl_user_checks.c:292
 #, c-format
 msgid ""
 "pam_setcred: [%s]\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:295
+#: src/tools/sssctl/sssctl_user_checks.c:294
 msgid ""
 "testing pam_open_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:297
+#: src/tools/sssctl/sssctl_user_checks.c:296
 #, c-format
 msgid ""
 "pam_open_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:299
+#: src/tools/sssctl/sssctl_user_checks.c:298
 msgid ""
 "testing pam_close_session\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:301
+#: src/tools/sssctl/sssctl_user_checks.c:300
 #, c-format
 msgid ""
 "pam_close_session: %s\n"
 "\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:303
+#: src/tools/sssctl/sssctl_user_checks.c:302
 msgid "unknown action\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:306
+#: src/tools/sssctl/sssctl_user_checks.c:305
 msgid "PAM Environment:\n"
 msgstr ""
 
-#: src/tools/sssctl/sssctl_user_checks.c:314
+#: src/tools/sssctl/sssctl_user_checks.c:313
 msgid " - no env -\n"
 msgstr ""
 
-#: src/util/util.h:97
+#: src/util/util.h:98
 msgid "Specify a non-default config file"
 msgstr "指定非預設的配置檔"
 
-#: src/util/util.h:104
+#: src/util/util.h:105
 msgid "Informs that the responder has been socket-activated"
 msgstr ""
 
diff --git a/src/man/po/br.po b/src/man/po/br.po
index c6deaf71198..31d1187a14e 100644
--- a/src/man/po/br.po
+++ b/src/man/po/br.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2014-12-14 11:51-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Breton (http://www.transifex.com/projects/p/sssd/language/"
@@ -210,13 +210,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Dre ziouer : true"
 
@@ -233,11 +233,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -270,8 +270,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -301,8 +301,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -338,46 +338,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Dre ziouer : 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domanioù"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -388,19 +369,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -408,12 +389,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -421,70 +402,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -492,7 +473,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -500,52 +481,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -553,14 +534,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -570,17 +551,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -590,7 +571,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -603,8 +584,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -612,12 +593,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -627,7 +608,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -636,22 +617,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -659,12 +640,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -672,61 +653,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -734,12 +715,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -747,24 +728,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -773,12 +754,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -787,7 +768,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -795,58 +776,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -857,7 +838,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -875,18 +856,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -894,12 +875,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -907,28 +888,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "passkey_verification (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "user_verification (boolean)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -936,7 +917,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -955,12 +936,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "RANNOÙ SERVIJOÙ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -969,22 +950,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -994,17 +975,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1014,19 +995,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 60, KCM: 300"
 msgstr "Dre ziouer : 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1037,14 +1018,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1052,44 +1033,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1098,62 +1079,62 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 3600"
 msgstr "Dre ziouer : 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 30"
 msgstr "Dre ziouer : 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1165,58 +1146,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Dre ziouer : 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1224,7 +1205,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1234,7 +1215,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1243,17 +1224,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1261,17 +1242,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Dre ziouer : 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1279,17 +1260,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1298,7 +1279,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1307,41 +1288,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Dre zoiuer : root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1349,23 +1330,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1373,47 +1354,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1421,113 +1402,113 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1535,25 +1516,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1561,19 +1542,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1581,12 +1562,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1595,12 +1576,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1611,45 +1592,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: true"
 msgid "Default: <quote>*</quote>"
 msgstr "Dre ziouer : true"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1658,60 +1639,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1719,61 +1700,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Dre zoiuer : 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pam_response_filter (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1782,51 +1763,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1837,23 +1818,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1861,7 +1842,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1870,17 +1851,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1888,31 +1869,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Dre ziouer : 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1922,75 +1904,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1998,19 +1980,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2018,46 +2000,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2065,36 +2047,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pam_cert_verification (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2104,7 +2086,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2112,61 +2094,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2174,7 +2156,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2186,63 +2168,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2250,12 +2232,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2266,7 +2248,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2274,7 +2256,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2282,7 +2264,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2291,47 +2273,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2340,30 +2322,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2371,7 +2353,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2379,22 +2361,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2402,19 +2384,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2422,7 +2404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2437,7 +2419,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2445,45 +2427,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2491,7 +2473,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2499,17 +2481,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2520,24 +2502,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2547,22 +2529,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2570,51 +2552,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2623,12 +2605,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2638,7 +2620,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2646,7 +2628,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2655,38 +2637,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2697,7 +2679,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2708,24 +2690,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2733,19 +2715,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2754,7 +2736,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2763,26 +2745,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pac_check (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2793,24 +2775,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2818,24 +2800,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2847,7 +2829,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2858,60 +2840,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2921,66 +2903,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2988,17 +2970,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3006,7 +2988,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3015,61 +2997,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "exclude_users (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "filter_users, filter_groups (string)"
 msgid "exclude_groups (string)"
 msgstr "filter_users, filter_groups (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "RANNOÙ DOMANI"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3079,12 +3061,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3093,14 +3075,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3109,38 +3091,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3149,24 +3131,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3175,36 +3157,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3218,14 +3200,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3234,14 +3216,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3249,32 +3231,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3283,19 +3265,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3306,139 +3288,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3447,17 +3429,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3469,18 +3451,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3491,7 +3473,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3500,12 +3482,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3513,19 +3495,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3534,17 +3516,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3553,28 +3535,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3582,7 +3564,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3590,8 +3572,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3599,8 +3581,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3608,19 +3590,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3629,7 +3611,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3637,24 +3619,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3666,7 +3648,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3674,30 +3656,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3705,7 +3687,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3713,30 +3695,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3744,19 +3726,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3765,7 +3747,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3773,29 +3755,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3803,7 +3785,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3811,35 +3793,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3847,32 +3829,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3883,7 +3865,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3892,12 +3874,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3905,7 +3887,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3913,31 +3895,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3945,7 +3927,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3954,17 +3936,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3972,36 +3954,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4009,7 +3991,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4017,7 +3999,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4025,24 +4007,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4050,31 +4032,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4082,7 +4064,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4091,12 +4073,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4106,24 +4088,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4132,19 +4114,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4154,102 +4136,107 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Dre ziouer : 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4258,12 +4245,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4271,7 +4258,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4279,36 +4266,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: TRUE"
 msgstr "Dre ziouer : 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4316,59 +4303,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Dre ziouer : 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4376,31 +4363,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4408,104 +4395,104 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4513,27 +4500,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4543,34 +4530,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4579,19 +4566,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4599,14 +4586,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "local_auth_policy (string)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4618,7 +4605,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4630,7 +4617,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4638,44 +4625,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4684,7 +4671,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4695,7 +4682,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4703,38 +4690,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: match"
 msgstr "Dre ziouer : 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4743,24 +4730,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4770,14 +4757,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4785,21 +4772,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4807,7 +4794,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4816,7 +4803,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4825,7 +4812,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4833,17 +4820,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4851,12 +4838,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4864,12 +4851,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4877,12 +4864,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4891,12 +4878,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4904,19 +4891,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4933,7 +4920,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4941,17 +4928,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4960,7 +4947,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4970,7 +4957,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -4990,12 +4977,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5006,69 +4993,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5081,7 +5068,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5089,7 +5076,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5098,55 +5085,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5155,17 +5142,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5173,26 +5160,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5201,17 +5188,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5221,7 +5208,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5230,59 +5217,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5291,7 +5278,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5299,18 +5286,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5318,46 +5316,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5366,7 +5364,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5374,12 +5372,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5408,7 +5406,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5417,7 +5415,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5425,7 +5423,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5436,7 +5434,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5447,7 +5445,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5609,7 +5607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -6021,7 +6019,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6274,7 +6272,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6291,36 +6289,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6328,12 +6327,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6341,12 +6340,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6354,17 +6353,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6375,24 +6374,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6403,12 +6402,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6421,7 +6420,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6433,17 +6432,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6451,49 +6450,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6501,28 +6500,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6534,7 +6533,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6542,7 +6541,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6550,39 +6549,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6592,7 +6591,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6600,26 +6599,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6628,7 +6627,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6636,31 +6635,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6673,51 +6672,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6726,12 +6725,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6747,12 +6746,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6761,14 +6760,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6777,24 +6776,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6802,19 +6801,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6823,7 +6822,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6831,7 +6830,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6840,7 +6839,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6848,22 +6847,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6873,14 +6872,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6893,12 +6892,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6908,81 +6907,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -6991,74 +6991,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7069,7 +7069,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7077,66 +7077,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "re_expression (neudennad)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7150,12 +7166,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7163,43 +7179,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7207,14 +7223,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7224,19 +7240,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7244,7 +7260,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7252,106 +7268,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7360,59 +7376,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7421,22 +7437,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7445,14 +7461,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7460,7 +7476,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7473,27 +7489,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7509,13 +7525,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9762,7 +9778,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9777,7 +9793,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9792,12 +9808,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9818,12 +9834,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9847,17 +9863,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9865,17 +9881,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9883,7 +9899,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9910,7 +9926,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9923,12 +9939,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9942,7 +9958,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9954,60 +9970,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10157,26 +10173,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10195,7 +10211,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10910,14 +10926,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10926,7 +10944,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10935,14 +10953,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10955,7 +10973,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10964,7 +10982,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10982,24 +11000,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11008,7 +11026,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11017,12 +11035,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11032,7 +11050,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11041,7 +11059,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11050,7 +11068,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11060,21 +11078,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11084,7 +11102,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11099,23 +11117,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11123,22 +11141,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11149,7 +11167,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11157,74 +11175,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11234,12 +11252,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11247,12 +11265,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11268,14 +11286,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11283,7 +11301,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11295,42 +11313,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11346,7 +11364,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11354,7 +11372,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11362,7 +11380,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11374,22 +11392,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11405,7 +11423,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11413,7 +11431,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11421,7 +11439,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11433,22 +11451,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11463,14 +11481,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11478,7 +11496,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11490,23 +11508,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11522,14 +11540,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11537,7 +11555,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11548,19 +11566,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11568,7 +11586,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11580,29 +11598,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11610,12 +11628,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11628,52 +11646,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11681,17 +11699,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11701,17 +11719,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11720,12 +11738,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11736,12 +11754,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11752,7 +11770,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11767,7 +11785,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11779,7 +11797,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11790,19 +11808,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11812,7 +11830,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11820,7 +11838,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11835,7 +11853,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11844,7 +11862,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11852,7 +11870,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11862,7 +11880,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12345,74 +12363,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14215,7 +14246,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14236,8 +14267,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17910,14 +17990,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/ca.po b/src/man/po/ca.po
index eb1ecd0f8b6..bddcd4c7523 100644
--- a/src/man/po/ca.po
+++ b/src/man/po/ca.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2015-10-18 04:13-0400\n"
 "Last-Translator: Robert Antoni Buj Gelonch <rbuj@fedoraproject.org>\n"
 "Language-Team: Catalan (http://www.transifex.com/projects/p/sssd/language/"
@@ -246,13 +246,13 @@ msgstr ""
 "opció."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Per defecte: true"
 
@@ -272,11 +272,11 @@ msgstr ""
 "aleshores s'ignora aquesta opció."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Per defecte: false"
@@ -311,8 +311,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -342,8 +342,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Per defecte: 10"
 
@@ -378,12 +378,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
-msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
+msgid ""
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Serveis admesos: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
 "<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
@@ -392,41 +398,20 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (enter)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"El nombre de vegades que els serveis haurien d'intentar tornar a connectar "
-"en cas de caiguda o reinici del proveïdor de dades abans de donar-se per "
-"vençuts"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Per defecte: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domains"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -437,12 +422,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -451,7 +436,7 @@ msgstr ""
 "conté el nom d'usuari i el domini en aquests components."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -459,12 +444,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -475,40 +460,40 @@ msgstr ""
 "compondre un FQN des dels components del nom d'usuari i del nom del domini."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "nom d'usuari"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 "el nom del domini tal com s'especifica al fitxer de configuració de l'SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -517,31 +502,31 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -549,7 +534,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -560,7 +545,7 @@ msgstr ""
 "d'establir aquesta opció a «false»"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -569,7 +554,7 @@ msgstr ""
 "altres plataformes."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -578,12 +563,12 @@ msgstr ""
 "disponible. En aquestes plataformes, sempre s'utilitzarà el sondeig."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -592,7 +577,7 @@ msgstr ""
 "cau de repetició del Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -602,7 +587,7 @@ msgstr ""
 "auxiliar de reproducció."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -611,12 +596,12 @@ msgstr ""
 "construcció. (__LIBKRB5_DEFAULTS__ si no està configurat)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr "user (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -624,14 +609,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -641,17 +626,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr "Per defecte: sense establir, els processos s'executaran com a root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -667,7 +652,7 @@ msgstr ""
 "nom d'usuari sense donar també un nom de domini."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -680,8 +665,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -689,12 +674,12 @@ msgid "Default: not set"
 msgstr "Per defecte: sense establir"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr "override_space (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -704,7 +689,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -713,22 +698,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Per defecte: sense establir (no se substituiran els espais)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -736,12 +721,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -749,61 +734,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -811,12 +796,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -824,24 +809,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 #, fuzzy
 #| msgid ""
 #| "The skeleton directory, which contains files and directories to be copied "
@@ -860,12 +845,12 @@ msgstr ""
 "manvolnum></citerefentry>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -874,7 +859,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -882,58 +867,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -944,7 +929,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -962,20 +947,20 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Per defecte: Sense establir"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 #, fuzzy
 #| msgid "ipa_server_mode (boolean)"
 msgid "implicit_pac_responder (boolean)"
 msgstr "ipa_server_mode (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -983,14 +968,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 #, fuzzy
 #| msgid "ad_enable_gc (boolean)"
 msgid "core_dumpable (boolean)"
 msgstr "ad_enable_gc (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -998,28 +983,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "ldap_user_certificate (string)"
 msgid "passkey_verification (string)"
 msgstr "ldap_user_certificate (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "ldap_user_certificate (string)"
 msgid "user_verification (boolean)"
 msgstr "ldap_user_certificate (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1027,7 +1012,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -1058,12 +1043,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "SECCIONS DELS SERVEIS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1076,22 +1061,22 @@ msgstr ""
 "quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Opcions de configuració del servei general"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Es poden utilitzar aquestes opcions per configurar qualsevol servei."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1101,17 +1086,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1121,19 +1106,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 60, KCM: 300"
 msgstr "Per defecte: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1144,14 +1129,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1159,46 +1144,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Per defecte: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "offline_timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1207,66 +1192,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "Per defecte: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "offline_timeout + random_offset"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout + random_offset"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 #, fuzzy
 #| msgid "offline_timeout + random_offset"
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "offline_timeout + random_offset"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "Per defecte: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1278,30 +1263,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Per defecte: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "Opcions de configuració de l'NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1309,12 +1294,12 @@ msgstr ""
 "Service Switch)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1323,17 +1308,17 @@ msgstr ""
 "(peticions d'informació sobre tots els usuaris)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Per defecte: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1344,7 +1329,7 @@ msgstr ""
 "valor entry_cache_timeout per al domini."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1360,7 +1345,7 @@ msgstr ""
 "peticions que esperen per a una actualització de la memòria cau."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1373,17 +1358,17 @@ msgstr ""
 "(0 desactiva aquesta característica)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Per defecte: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1395,17 +1380,17 @@ msgstr ""
 "altra vegada."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Per defecte: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1413,17 +1398,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1432,7 +1417,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1441,17 +1426,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Per defecte: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1459,12 +1444,12 @@ msgstr ""
 "aquesta opció a false."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1473,7 +1458,7 @@ msgstr ""
 "si no se n'especifica cap explícitament amb el proveïdor de dades del domini."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1481,7 +1466,7 @@ msgstr ""
 "override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1491,25 +1476,25 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "exemple: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 "Per defecte: sense establir (cap substitució per als directoris inicials no "
 "establerts)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1520,18 +1505,18 @@ msgstr ""
 "pot configurar ja sigui en la secció [nss] o per cada domini."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "Per defecte: sense establir (SSSD utilitzarà el valor recuperat del LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1539,31 +1524,31 @@ msgstr ""
 "d'avaluació és:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr "1. Si el shell està present al <quote>/etc/shells</quote>, s'utilitza."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1571,117 +1556,117 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Per defecte: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "enum_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "enum_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1689,27 +1674,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr "Per defecte: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "enum_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1717,21 +1702,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Per defecte: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "enum_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1739,14 +1724,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "enum_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1755,12 +1740,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1771,45 +1756,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>permit</quote>"
 msgid "Default: <quote>*</quote>"
 msgstr "Per defecte: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1818,12 +1803,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "Opcions de configuració del PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -1832,12 +1817,12 @@ msgstr ""
 "(Pluggable Authentication Module)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -1847,17 +1832,17 @@ msgstr ""
 "de sessió)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Per defecte: 0 (sense límit)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -1866,12 +1851,12 @@ msgstr ""
 "fallits es permet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -1881,7 +1866,7 @@ msgstr ""
 "possible."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1889,17 +1874,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Per defecte: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -1908,45 +1893,45 @@ msgstr ""
 "l'autenticació. Com més gran sigui el nombre més missatges es mostren."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "L'sssd actualment admet els següents valors:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: no mostris cap missatge"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: Mostra només missatges importants"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: Mostra missatges informatius"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: Mostra tots els missatges i informació de depuració"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Per defecte: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "ad_access_filter (string)"
 msgid "pam_response_filter (string)"
 msgstr "ad_access_filter (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1955,51 +1940,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2010,23 +1995,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2038,7 +2023,7 @@ msgstr ""
 "l'última informació."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2052,17 +2037,17 @@ msgstr ""
 "excessives al proveïdor d'identitat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2070,31 +2055,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Per defecte: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2104,75 +2090,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Per defecte: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2180,19 +2166,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2200,48 +2186,48 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 #, fuzzy
 #| msgid "ldap_chpass_update_last_change (bool)"
 msgid "pam_passkey_auth (bool)"
 msgstr "ldap_chpass_update_last_change (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Per defecte: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Per defecte: False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2249,36 +2235,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "ldap_user_certificate (string)"
 msgid "pam_cert_verification (string)"
 msgstr "ldap_user_certificate (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2288,7 +2274,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, fuzzy, no-wrap
 #| msgid ""
 #| "ad_gpo_map_service = +my_pam_service\n"
@@ -2301,63 +2287,63 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "pam_id_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "ad_gpo_map_service (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "ad_gpo_map_service (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2365,7 +2351,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2377,63 +2363,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2441,12 +2427,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2457,7 +2443,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2465,7 +2451,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2473,7 +2459,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2482,47 +2468,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2531,19 +2517,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 #, fuzzy
 #| msgid "ad_gpo_map_service (string)"
 msgid "pam_gssapi_services"
 msgstr "ad_gpo_map_service (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 #, fuzzy
 #| msgid "Comma separated list of users who are allowed to log in."
 msgid ""
@@ -2553,13 +2539,13 @@ msgstr ""
 "Llista separada per comes dels usuaris a qui se'ls permet iniciar la sessió."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2567,7 +2553,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, fuzzy, no-wrap
 #| msgid ""
 #| "ad_gpo_map_service = +my_pam_service\n"
@@ -2580,22 +2566,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Exemple: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2603,19 +2589,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2623,7 +2609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2638,7 +2624,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2646,45 +2632,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, fuzzy, no-wrap
 #| msgid ""
 #| "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -2697,7 +2683,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2705,7 +2691,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 #, fuzzy
 #| msgid "Default: not set (no substitution for unset home directories)"
 msgid "Default: not set (use of authentication indicators is not required)"
@@ -2714,12 +2700,12 @@ msgstr ""
 "establerts)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "Opcions de configuració de SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2737,24 +2723,24 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2764,23 +2750,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 "Es poden utilitzar aquestes opcions per configurar el servei de l'autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2788,51 +2774,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr "Es poden utilitzar aquestes opcions per configurar el servei de l'SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "Per defecte: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2841,12 +2827,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2856,7 +2842,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2864,7 +2850,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2873,38 +2859,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "Opcions de configuració del contestador del PAC."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2915,7 +2901,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2926,25 +2912,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 "Es poden utilitzar aquestes opcions per configurar el contestador del PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2952,7 +2938,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 #, fuzzy
 #| msgid ""
 #| "Default: 0 (only the root user is allowed to access the InfoPipe "
@@ -2965,12 +2951,12 @@ msgstr ""
 "contestador de l'InfoPipe)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 #, fuzzy
 #| msgid ""
 #| "Please note that although the UID 0 is used as the default it will be "
@@ -2989,7 +2975,7 @@ msgstr ""
 "també cal afegir 0 a la llista dels UID permesos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2998,26 +2984,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "ldap_schema (string)"
 msgid "pac_check (string)"
 msgstr "ldap_schema (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3028,24 +3014,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3053,24 +3039,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3082,7 +3068,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3093,41 +3079,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -3140,19 +3126,19 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3162,66 +3148,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3229,17 +3215,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3247,7 +3233,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3256,65 +3242,65 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "exclude_users (string)"
 msgstr "simple_deny_users (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No users excluded."
 msgstr "Per defecte: buit, és a dir, s'utilitza ldap_uri."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "simple_deny_groups (string)"
 msgid "exclude_groups (string)"
 msgstr "simple_deny_groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No groups excluded."
 msgstr "Per defecte: buit, és a dir, s'utilitza ldap_uri."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "SECCIONS DE DOMINI"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3324,12 +3310,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3338,14 +3324,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3354,31 +3340,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id, max_id (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3387,7 +3373,7 @@ msgstr ""
 "fora d'aquests límits, s'ignora."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3400,24 +3386,24 @@ msgstr ""
 "com s'esperava."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Per defecte: 1 per a min_id, 0 (sense límit) per a max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3426,36 +3412,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = Els usuaris i grups s'enumeren"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = Cap enumeració per a aquest domini"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Per defecte: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3469,7 +3455,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3479,7 +3465,7 @@ msgstr ""
 "finalitzi."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3493,14 +3479,14 @@ msgstr ""
 "ús."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3508,32 +3494,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3542,12 +3528,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -3556,7 +3542,7 @@ msgstr ""
 "demanar al rerefons una altra vegada"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3567,139 +3553,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Per defecte: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "Per defecte: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3708,17 +3694,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3730,18 +3716,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "Per defecte: 0 (inhabilitat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3752,7 +3738,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3761,12 +3747,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3774,19 +3760,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3799,17 +3785,17 @@ msgstr ""
 "ha de ser superior o igual que offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Per defecte: 0 (sense límit)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3818,28 +3804,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Per defecte: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3847,7 +3833,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3855,8 +3841,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 #, fuzzy
 #| msgid ""
 #| "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
@@ -3872,8 +3858,8 @@ msgstr ""
 "manvolnum></citerefentry> per a més informació sobre configuració d'LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3881,19 +3867,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3906,7 +3892,7 @@ msgstr ""
 "l'usuari mentre que <command>getent passwd test@LOCAL</command> sí."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3914,24 +3900,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3943,7 +3929,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3951,23 +3937,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -3976,7 +3962,7 @@ msgstr ""
 "d'autenticació suportats són:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3987,7 +3973,7 @@ msgstr ""
 "manvolnum></citerefentry> per a més informació sobre configuració d'LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3998,7 +3984,7 @@ msgstr ""
 "manvolnum></citerefentry> per a més informació sobre configurar Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
@@ -4006,12 +3992,12 @@ msgstr ""
 "de PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> impossibilita l'autenticació explícitament."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4020,12 +4006,12 @@ msgstr ""
 "gestionar les sol·licituds d'autenticació."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4036,19 +4022,19 @@ msgstr ""
 "instal·lats) Els proveïdors especials interns són:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> sempre denega l'accés."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4061,7 +4047,7 @@ msgstr ""
 "configuració del mòdul d'accés simple."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4069,22 +4055,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Per defecte: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4093,7 +4079,7 @@ msgstr ""
 "al domini.  Els proveïdors de canvi de contrasenya compatibles són:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4101,7 +4087,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4112,7 +4098,7 @@ msgstr ""
 "manvolnum></citerefentry> per a més informació sobre configurar Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
@@ -4120,12 +4106,12 @@ msgstr ""
 "objectiu PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> rebutja els canvis de contrasenya explícitament."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4134,17 +4120,17 @@ msgstr ""
 "gestionar peticions de canvi de contrasenya."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4152,32 +4138,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4188,7 +4174,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4197,12 +4183,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4210,7 +4196,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4218,31 +4204,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4250,7 +4236,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4259,17 +4245,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4277,36 +4263,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4314,7 +4300,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4322,7 +4308,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4330,24 +4316,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4355,31 +4341,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4387,7 +4373,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4396,12 +4382,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4411,24 +4397,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4437,19 +4423,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4459,17 +4445,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Per defecte: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -4478,89 +4464,94 @@ msgstr ""
 "realitzar cerques de DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Valors admesos:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr "ipv4_first: Intenta resoldre l'adreça IPv4, si falla, intenta IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr "ipv4_only: Intenta resoldre només noms màquina a adreces IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr "ipv6_first: Intenta resoldre l'adreça IPv6, si falla, intenta IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr "ipv6_only: Intenta resoldre només noms màquina a adreces IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Per defecte: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Per defecte: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Per defecte: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4569,14 +4560,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4584,7 +4575,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4592,17 +4583,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Per defecte: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -4611,19 +4602,19 @@ msgstr ""
 "del domini de la consulta DNS del servei de descobriment."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr "Per defecte: Utilitza la part del domini del nom de màquina"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "pam_id_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4631,59 +4622,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Per defecte: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4691,14 +4682,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -4711,17 +4702,17 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4729,130 +4720,130 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_search_timeout (integer)"
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "ldap_network_timeout (integer)"
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "ldap_connection_expire_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout"
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 #, fuzzy
 #| msgid "ldap_krb5_ticket_lifetime (integer)"
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "ldap_enumeration_search_timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_expire_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 #, fuzzy
 #| msgid "case_sensitive (string)"
 msgid "case_sensitive"
 msgstr "case_sensitive (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4862,27 +4853,27 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4892,34 +4883,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Per defecte: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4928,19 +4919,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4948,14 +4939,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy (string)"
 msgstr "ldap_pwd_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4967,7 +4958,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4979,7 +4970,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4987,46 +4978,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_pwd_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 #, fuzzy
 #| msgid "gdm-smartcard"
 msgid "Smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5035,7 +5026,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5046,7 +5037,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 #, fuzzy
 #| msgid ""
 #| "The following example shows a minimal idmapd.conf which makes use of the "
@@ -5060,38 +5051,38 @@ msgstr ""
 "sss.  <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: cn"
 msgid "Default: match"
 msgstr "Per defecte: cn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5100,24 +5091,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5127,14 +5118,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5142,21 +5133,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5164,7 +5155,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5173,7 +5164,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5182,7 +5173,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -5193,17 +5184,17 @@ msgstr ""
 "replaceable>]</quote> <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "El servidor intermediari on reenvia PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 #, fuzzy
 #| msgid ""
 #| "Default: not set by default, you have to take an existing pam "
@@ -5217,12 +5208,12 @@ msgstr ""
 "de pam existent o crear-ne una de nova i afegir aquí el nom del servei."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -5233,12 +5224,12 @@ msgstr ""
 "format _nss_$(libName)_$(function), per exemple _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -5246,12 +5237,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -5260,12 +5251,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -5273,7 +5264,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -5282,12 +5273,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5304,7 +5295,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5312,17 +5303,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5331,7 +5322,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5341,7 +5332,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5361,12 +5352,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5377,69 +5368,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5452,7 +5443,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5460,7 +5451,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5469,55 +5460,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5526,17 +5517,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5544,26 +5535,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5572,17 +5563,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5592,7 +5583,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5601,59 +5592,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5662,7 +5653,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5670,18 +5661,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5689,39 +5691,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -5734,7 +5736,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5743,7 +5745,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5751,12 +5753,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[sssd]\n"
@@ -5834,7 +5836,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5843,7 +5845,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5851,7 +5853,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5862,7 +5864,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5873,7 +5875,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -6060,7 +6062,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Exemples:"
@@ -6492,7 +6494,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "Per defecte: 900 (15 minuts)"
 
@@ -6764,7 +6766,7 @@ msgstr ""
 "Certificació que reconeixerà l'<command>sssd</command>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6779,11 +6781,19 @@ msgstr "ldap_tls_cacertdir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "Especifica el camí al directori que conté els certificats de l'autoritat "
 "certificadora en fitxers separats independents. Normalment els noms dels "
@@ -6792,32 +6802,32 @@ msgstr ""
 "correctes."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6825,12 +6835,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 #, fuzzy
 #| msgid ""
 #| "Specifies that the id_provider connection must also use <systemitem "
@@ -6844,12 +6854,12 @@ msgstr ""
 "class=\"protocol\">tls</systemitem> per a protegir el canal."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6857,17 +6867,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6878,24 +6888,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6906,12 +6916,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6924,7 +6934,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6936,17 +6946,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6954,51 +6964,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "Per defecte: el valor de krb5_realm."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Per defecte: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Per defecte: Fitxer keytab de sistema, normalment <filename>/etc/krb5."
 "keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -7006,28 +7016,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Per defecte: 86400 (24 hores)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -7039,7 +7049,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -7050,7 +7060,7 @@ msgstr ""
 "retorna a _tcp si no se'n troba cap."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -7062,41 +7072,41 @@ msgstr ""
 "<quote>krb5_server</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 "Per defecte: Paràmetres predeterminats del sistema, vegeu <filename>/etc/"
 "krb5.conf</filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -7106,7 +7116,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -7114,12 +7124,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -7128,7 +7138,7 @@ msgstr ""
 "costat del client. S'admeten els valors següents:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -7137,7 +7147,7 @@ msgstr ""
 "opció no inhabilita les polítiques de contrasenya de servidor."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -7146,7 +7156,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -7158,25 +7168,25 @@ msgstr ""
 "contrasenya."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 "Especifica si el seguiment automàtic del referenciador s'hauria d'habilitar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -7185,7 +7195,7 @@ msgstr ""
 "quan es compila amb la versió 2.4.13 o superiors d'OpenLDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -7198,29 +7208,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "Especifica el nom de servei per utilitzar quan està habilitada la detecció "
 "de serveis."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Per defecte: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -7230,25 +7240,25 @@ msgstr ""
 "dels serveis."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 "Defecte: no definit, és a dir, el descobriment de serveis està inhabilitat"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -7257,12 +7267,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -7278,12 +7288,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Exemple:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7292,14 +7302,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -7308,17 +7318,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "Per defecte: Buit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -7327,7 +7337,7 @@ msgstr ""
 "d'atributs de control d'accés."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -7339,12 +7349,12 @@ msgstr ""
 "contrasenya és correcta."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "S'admeten els valors següents:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -7353,7 +7363,7 @@ msgstr ""
 "determinar si el compte ha caducat."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -7362,7 +7372,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -7370,7 +7380,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -7379,7 +7389,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -7387,24 +7397,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "Llista separada per comes d'opcions de control d'accés. Els valors permesos "
 "són:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis>: utilitza ldap_access_filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7414,14 +7424,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7434,12 +7444,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>expire</emphasis>: utilitza ldap_account_expire_policy"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -7449,38 +7459,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -7489,31 +7500,31 @@ msgstr ""
 "authorizedService per determinar l'accés"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Per defecte: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -7522,12 +7533,12 @@ msgstr ""
 "s'utilitza més d'una vegada."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr "ldap_pwdlockout_dn (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7536,22 +7547,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr "Exemple: cn=ppolicy,ou=policies,dc=exemple,dc=com"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr "Per defecte: cn=ppolicy,ou=policies,$ldap_search_base"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -7560,13 +7571,13 @@ msgstr ""
 "es fa una cerca. S'admeten les opcions següents:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 "<emphasis>never</emphasis>: les referències dels àlies mai són eliminades."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -7576,7 +7587,7 @@ msgstr ""
 "de la cerca."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -7585,7 +7596,7 @@ msgstr ""
 "només en localitzar l'objecte base de la cerca."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -7594,7 +7605,7 @@ msgstr ""
 "en la recerca i en la localització de l'objecte base de la cerca."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -7603,19 +7614,19 @@ msgstr ""
 "biblioteques de client LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7626,7 +7637,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7634,70 +7645,88 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "debug_level (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "debug_level (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 #, fuzzy
 #| msgid "Default: 0 (disabled)"
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "Per defecte: 0 (inhabilitat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "ldap_id_mapping (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_id_mapping (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (enter)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7711,12 +7740,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "OPCIONS DE SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7724,43 +7753,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "Per defecte: 21600 (6 hores)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7768,14 +7797,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7785,21 +7814,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_idmap_range_size (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7807,7 +7836,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7815,106 +7844,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7923,59 +7952,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "OPCIONS D'AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "Per defecte: auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "OPCIONS AVANÇADES"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr "<note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7984,22 +8013,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr "</note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -8008,14 +8037,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "EXEMPLE"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -8026,7 +8055,7 @@ msgstr ""
 "replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8039,27 +8068,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8075,13 +8104,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTES"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -10453,7 +10482,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (booleà)"
 
@@ -10468,7 +10497,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -10483,12 +10512,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -10509,12 +10538,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -10538,17 +10567,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -10556,19 +10585,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 #, fuzzy
 #| msgid "dyndns_iface (string)"
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_iface (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -10576,7 +10605,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -10603,7 +10632,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (enter)"
 
@@ -10616,12 +10645,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -10635,7 +10664,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -10647,60 +10676,60 @@ msgid "Default: False (disabled)"
 msgstr "Per defecte: False (inhabilitat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10856,26 +10885,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr "krb5_confd_path (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10894,7 +10923,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "Per defecte: 5 (segons)"
 
@@ -11619,14 +11648,16 @@ msgstr "ad_access_filter (cadena)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -11635,7 +11666,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -11644,14 +11675,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -11664,7 +11695,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -11673,7 +11704,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -11691,24 +11722,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr "ad_site (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11717,7 +11748,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11726,12 +11757,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11741,7 +11772,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11750,7 +11781,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11759,7 +11790,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11769,21 +11800,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11793,7 +11824,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11808,23 +11839,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11832,22 +11863,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "Per defecte: permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr "Per defecte: enforcing"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11858,7 +11889,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11866,82 +11897,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "all users are allowed"
 msgstr "S'admeten els valors següents:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "only users in allow-rules are allowed"
 msgstr "S'admeten els valors següents:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 #, fuzzy
 #| msgid "ad_gpo_map_deny (string)"
 msgid "ad_gpo_implicit_deny = True"
 msgstr "ad_gpo_map_deny (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "no users are allowed"
 msgstr "S'admeten els valors següents:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11951,12 +11982,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr "ad_gpo_cache_timeout (enter)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11964,12 +11995,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr "ad_gpo_map_interactive (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11985,14 +12016,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -12002,7 +12033,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12014,42 +12045,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr "gdm-fingerprint"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr "ad_gpo_map_remote_interactive (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -12065,7 +12096,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -12073,7 +12104,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -12083,7 +12114,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12095,22 +12126,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr "sshd"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr "ad_gpo_map_network (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -12126,7 +12157,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -12134,7 +12165,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -12144,7 +12175,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12156,22 +12187,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr "ftp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr "samba"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr "ad_gpo_map_batch (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -12186,14 +12217,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -12203,7 +12234,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12215,23 +12246,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr "crond"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr "ad_gpo_map_service (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -12247,14 +12278,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -12264,7 +12295,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -12275,19 +12306,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr "ad_gpo_map_permit (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -12297,7 +12328,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12309,29 +12340,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr "systemd-user"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr "ad_gpo_map_deny (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -12341,12 +12372,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr "ad_gpo_default_right (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -12359,52 +12390,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -12412,17 +12443,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -12432,17 +12463,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -12451,12 +12482,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -12467,14 +12498,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 #, fuzzy
 #| msgid "ldap_sudo_include_netgroups (boolean)"
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ldap_sudo_include_netgroups (booleà)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -12485,7 +12516,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -12500,7 +12531,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -12512,7 +12543,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -12523,19 +12554,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "Per defecte: 3600 (segons)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -12545,7 +12576,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -12553,7 +12584,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -12577,7 +12608,7 @@ msgstr ""
 "ad_domain = exemple.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -12589,7 +12620,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -12597,7 +12628,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -12607,7 +12638,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -13146,76 +13177,89 @@ msgstr ""
 "Diu a l'SSSD que es desconnecti immediatament. Això és útil per fer proves. "
 "El senyal es pot enviar directament al procés sssd o sssd_be."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 #, fuzzy
 #| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
 msgstr "Opcions de configuració de l'NSS"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -15215,7 +15259,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -15250,8 +15294,59 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-H</option>,<option>--ssh-hosts</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-H</option>,<option>--ssh-hosts</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -19044,14 +19139,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -19614,6 +19708,17 @@ msgid ""
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (enter)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "El nombre de vegades que els serveis haurien d'intentar tornar a "
+#~ "connectar en cas de caiguda o reinici del proveïdor de dades abans de "
+#~ "donar-se per vençuts"
+
 #, fuzzy
 #~| msgid "These options can be used to configure the InfoPipe responder."
 #~ msgid "This option is ignored for the files provider."
diff --git a/src/man/po/cs.po b/src/man/po/cs.po
index 95ed6424257..def0eb2577f 100644
--- a/src/man/po/cs.po
+++ b/src/man/po/cs.po
@@ -10,11 +10,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2024-09-02 11:38+0000\n"
 "Last-Translator: Jan Kalabza <jan.kalabza@gmail.com>\n"
-"Language-Team: Czech <https://translate.fedoraproject.org/projects/sssd/"
-"sssd-manpage-master/cs/>\n"
+"Language-Team: Czech <https://translate.fedoraproject.org/projects/sssd/sssd-"
+"manpage-master/cs/>\n"
 "Language: cs\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -228,13 +228,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Výchozí: true (pravda)"
 
@@ -251,11 +251,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Výchozí: false (nepravda)"
@@ -288,8 +288,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -319,8 +319,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Výchozí: 10"
 
@@ -356,46 +356,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Výchozí: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domény"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -406,19 +387,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -426,12 +407,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -439,58 +420,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "uživatelské jméno"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -499,12 +480,12 @@ msgstr ""
 "zapotřebí aktualizovat svůj vestavěný překlad DNS názvů."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -512,7 +493,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -520,26 +501,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -548,26 +529,26 @@ msgstr ""
 "replay."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -575,14 +556,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -592,17 +573,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -612,7 +593,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -625,8 +606,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -634,12 +615,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -649,7 +630,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -658,22 +639,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Výchozí: nenastaveno (mezery nebudou nahrazovány)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -681,12 +662,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -694,61 +675,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -756,12 +737,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -769,24 +750,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -795,12 +776,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -809,7 +790,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -817,58 +798,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -879,7 +860,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -897,18 +878,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -916,12 +897,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -929,24 +910,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -954,7 +935,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -973,12 +954,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -987,22 +968,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1012,17 +993,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1032,19 +1013,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 200000"
 msgid "Default: 60, KCM: 300"
 msgstr "Výchozí: 200000"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1055,14 +1036,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1070,46 +1051,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Výchozí: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "ldap_idmap_range_max (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "ldap_idmap_range_max (celé číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1118,62 +1099,62 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 200000"
 msgid "Default: 3600"
 msgstr "Výchozí: 200000"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "ldap_idmap_range_size (celé číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr "Výchozí: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1185,58 +1166,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Výchozí: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1247,7 +1228,7 @@ msgstr ""
 "doménu."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1257,7 +1238,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1266,17 +1247,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Výchozí: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1284,17 +1265,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Výchozí: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1302,17 +1283,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1321,7 +1302,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1330,41 +1311,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1372,23 +1353,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "příklad: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1396,47 +1377,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1444,74 +1425,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1520,39 +1501,39 @@ msgstr ""
 "platný."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1560,27 +1541,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "ldap_idmap_range_size (celé číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1588,19 +1569,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1608,14 +1589,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "ldap_idmap_range_size (celé číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1624,12 +1605,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1640,43 +1621,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1685,60 +1666,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1746,59 +1727,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Výchozí: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1807,51 +1788,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1862,23 +1843,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1886,7 +1867,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1895,17 +1876,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "Zobrazit varování N dnů před skončením platnosti hesla."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1913,31 +1894,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1947,75 +1929,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Výchozí: nic"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2023,19 +2005,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2043,46 +2025,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Výchozí: true (pravda)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Výchozí: false (nepravda)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2090,34 +2072,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr "Výchozí:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2127,7 +2109,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2135,63 +2117,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr "Kolik sekund bude pam_sss čekat na dokončení p11_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "timeout (celé kladné číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "simple_allow_users (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "simple_allow_users (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2199,7 +2181,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2211,63 +2193,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "přihlášení"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2275,12 +2257,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2291,7 +2273,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2299,7 +2281,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2307,7 +2289,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2316,47 +2298,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr "vždy"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr "nikdy"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2365,30 +2347,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2396,7 +2378,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2404,22 +2386,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Příklad: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2427,19 +2409,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2447,7 +2429,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2462,7 +2444,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2470,45 +2452,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2516,7 +2498,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2524,17 +2506,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2545,24 +2527,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2572,22 +2554,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2595,22 +2577,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -2619,12 +2601,12 @@ msgstr ""
 "zaheslovat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -2633,17 +2615,17 @@ msgstr ""
 "byly vyžádány klíče hostitele."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2652,12 +2634,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2667,7 +2649,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2675,7 +2657,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2684,38 +2666,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2726,7 +2708,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2737,24 +2719,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2762,19 +2744,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2783,7 +2765,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2792,26 +2774,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "krb5_rcache_dir (string)"
 msgid "pac_check (string)"
 msgstr "krb5_rcache_dir (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2822,24 +2804,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2847,24 +2829,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2876,7 +2858,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2887,60 +2869,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2950,49 +2932,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr "\"vše\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr "Všichni uživatelé jsou zaznamenáni."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3001,17 +2983,17 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3022,17 +3004,17 @@ msgstr ""
 "mezer, změně velikosti písmen, atd."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3043,7 +3025,7 @@ msgstr ""
 "nahrazení mezer, změn velikosti písmen, atd."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3052,61 +3034,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "exclude_users (string)"
 msgstr "simple_deny_users (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "simple_deny_groups (string)"
 msgid "exclude_groups (string)"
 msgstr "simple_deny_groups (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3116,12 +3098,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3130,14 +3112,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3146,38 +3128,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3186,24 +3168,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3212,36 +3194,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3255,14 +3237,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3271,14 +3253,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3286,32 +3268,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3320,19 +3302,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3343,108 +3325,108 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -3453,31 +3435,31 @@ msgstr ""
 "dlouhou dobu ponechávat klíč hostitel v mezipaměti."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3486,17 +3468,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3508,18 +3490,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3530,7 +3512,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3539,12 +3521,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3556,19 +3538,19 @@ msgstr ""
 "otisk do mezipaměti."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3577,17 +3559,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3596,28 +3578,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3625,7 +3607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3633,8 +3615,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3642,8 +3624,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3651,19 +3633,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3672,7 +3654,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3680,24 +3662,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3709,7 +3691,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3717,30 +3699,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3748,7 +3730,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3756,30 +3738,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3787,19 +3769,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3808,7 +3790,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3816,29 +3798,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3846,7 +3828,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3854,35 +3836,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3890,32 +3872,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3926,7 +3908,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3935,12 +3917,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3948,7 +3930,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3956,31 +3938,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3988,7 +3970,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3997,17 +3979,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4015,36 +3997,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4052,7 +4034,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4060,7 +4042,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4068,24 +4050,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4093,31 +4075,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4125,7 +4107,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4134,12 +4116,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4149,7 +4131,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
@@ -4158,17 +4140,17 @@ msgstr ""
 # auto translated by TM merge from project: Fedora Websites, version:
 # fedorahosted.org, DocId: po/fedorahosted
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4177,19 +4159,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4199,106 +4181,111 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Výchozí: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4307,14 +4294,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4322,7 +4309,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4330,38 +4317,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: TRUE"
 msgstr "Výchozí: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "failover_primary_timeout (integer)"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4369,59 +4356,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Výchozí: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4429,31 +4416,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4461,120 +4448,120 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "dns_resolver_timeout"
 msgid "ldap_search_timeout"
 msgstr "dns_resolver_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "dns_resolver_timeout"
 msgid "ldap_network_timeout"
 msgstr "dns_resolver_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "ldap_opt_timeout"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "dns_resolver_timeout"
 msgid "ldap_offline_timeout"
 msgstr "dns_resolver_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "ldap_enumeration_search_timeout"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "ldap_connection_expire_timeout"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "dns_resolver_op_timeout"
 msgid "ldap_connection_expire_offset"
 msgstr "dns_resolver_op_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4582,27 +4569,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4612,34 +4599,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr "Různé štítky uložené službou nastavování realmd pro tuto doménu."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4648,19 +4635,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4668,14 +4655,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "local_auth_policy (string)"
 msgstr "simple_deny_users (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4687,7 +4674,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4699,7 +4686,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4707,44 +4694,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "simple_deny_users (řetězec)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4753,7 +4740,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4764,7 +4751,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4772,38 +4759,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: match"
 msgstr "Výchozí: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4812,24 +4799,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4839,14 +4826,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4854,21 +4841,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4876,7 +4863,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4885,7 +4872,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4894,7 +4881,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4902,17 +4889,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4920,12 +4907,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4933,12 +4920,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4946,12 +4933,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4960,12 +4947,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4973,19 +4960,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5002,7 +4989,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5010,17 +4997,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5029,7 +5016,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5039,7 +5026,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5059,12 +5046,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5075,69 +5062,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5150,7 +5137,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5158,7 +5145,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5167,55 +5154,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5224,17 +5211,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5242,26 +5229,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5270,17 +5257,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5290,7 +5277,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5299,59 +5286,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5360,7 +5347,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5368,18 +5355,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5387,46 +5385,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5435,7 +5433,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5443,12 +5441,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5477,7 +5475,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5486,7 +5484,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5494,7 +5492,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5505,7 +5503,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5516,7 +5514,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5678,7 +5676,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -6092,7 +6090,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6347,7 +6345,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6364,36 +6362,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6401,12 +6400,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6414,12 +6413,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6427,17 +6426,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6448,24 +6447,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6476,12 +6475,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6494,7 +6493,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6506,17 +6505,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6524,49 +6523,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6574,28 +6573,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6607,7 +6606,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6615,7 +6614,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6623,39 +6622,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6665,7 +6664,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6673,26 +6672,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6701,7 +6700,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6709,31 +6708,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6746,51 +6745,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6799,12 +6798,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6820,12 +6819,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6834,14 +6833,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6850,24 +6849,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6875,19 +6874,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6896,7 +6895,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6904,7 +6903,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6913,7 +6912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6921,22 +6920,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6946,14 +6945,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6966,12 +6965,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6981,81 +6980,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7064,67 +7064,67 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -7133,7 +7133,7 @@ msgstr ""
 "používají schéma dle normy RFC2307."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7144,7 +7144,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7152,66 +7152,84 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "ldap_idmap_range_size (celé číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_idmap_range_size (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_idmap_range_size (celé číslo)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7225,12 +7243,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7238,43 +7256,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7282,14 +7300,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7299,21 +7317,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_idmap_range_size (celé číslo)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7321,7 +7339,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7329,106 +7347,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7437,59 +7455,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "Název v LDAP hlavní mapy pro automatické připojování."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7498,22 +7516,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7522,14 +7540,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7537,7 +7555,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7550,27 +7568,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7586,13 +7604,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9864,7 +9882,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9879,7 +9897,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9894,12 +9912,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9920,12 +9938,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9949,17 +9967,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9967,17 +9985,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9985,7 +10003,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -10012,7 +10030,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -10025,12 +10043,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -10044,7 +10062,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -10056,60 +10074,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10261,26 +10279,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10299,7 +10317,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -11014,14 +11032,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -11030,7 +11050,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -11039,14 +11059,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -11059,7 +11079,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -11068,7 +11088,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -11086,24 +11106,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11112,7 +11132,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11121,12 +11141,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11136,7 +11156,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11145,7 +11165,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11154,7 +11174,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11164,21 +11184,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11188,7 +11208,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11203,23 +11223,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11227,22 +11247,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11253,7 +11273,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11261,74 +11281,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11338,12 +11358,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11351,12 +11371,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11372,14 +11392,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11387,7 +11407,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11399,42 +11419,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11450,7 +11470,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11458,7 +11478,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11466,7 +11486,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11478,22 +11498,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11509,7 +11529,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11517,7 +11537,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11525,7 +11545,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11537,22 +11557,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11567,14 +11587,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11582,7 +11602,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11594,23 +11614,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11626,14 +11646,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11641,7 +11661,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11652,19 +11672,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11672,7 +11692,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11684,29 +11704,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11714,12 +11734,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11732,52 +11752,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11785,17 +11805,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11805,17 +11825,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11824,12 +11844,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11840,12 +11860,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11856,7 +11876,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11871,7 +11891,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11883,7 +11903,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11894,19 +11914,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11916,7 +11936,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11924,7 +11944,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11939,7 +11959,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11948,7 +11968,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11956,7 +11976,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11966,7 +11986,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12449,74 +12469,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14319,7 +14352,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14340,8 +14373,59 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-?</option>,<option>--help</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-?</option>,<option>--help</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -18019,14 +18103,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/de.po b/src/man/po/de.po
index fb63278bad6..98c7372e419 100644
--- a/src/man/po/de.po
+++ b/src/man/po/de.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2021-02-02 14:40+0000\n"
 "Last-Translator: Sumit Bose <sbose@redhat.com>\n"
 "Language-Team: German <https://translate.fedoraproject.org/projects/sssd/"
@@ -234,13 +234,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Voreinstellung: »true«"
 
@@ -257,11 +257,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Voreinstellung: »false«"
@@ -296,8 +296,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -327,8 +327,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Voreinstellung: 10"
 
@@ -363,12 +363,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Unterstützte Dienste sind: nss, pam <phrase condition=\"with_sudo\">, sudo</"
 "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
@@ -377,41 +383,20 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (Ganzzahl)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Anzahl der Versuche, die ein Dienst unternehmen sollte, um sich erneut zu "
-"verbinden, bevor er aufgibt, falls ein Datenanbieter abgestürzt ist oder neu "
-"startet."
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Voreinstellung: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "Domains"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -422,12 +407,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -437,7 +422,7 @@ msgstr ""
 "werden sollen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -445,12 +430,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -462,32 +447,32 @@ msgstr ""
 "zusammengestellt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "Benutzername"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr "Domain-Name, wie er durch die SSSD-Konfigurationsdatei angegeben wird"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -496,7 +481,7 @@ msgstr ""
 "direkt konfiguriert als auch über IPA-Trust"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -505,31 +490,31 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -537,7 +522,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -548,7 +533,7 @@ msgstr ""
 "sollte diese Option auf »false« gesetzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -557,7 +542,7 @@ msgstr ""
 "»false« auf anderen Plattformen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -566,12 +551,12 @@ msgstr ""
 "verfügbar ist, keine Auswirkungen haben."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -579,7 +564,7 @@ msgstr ""
 "Verzeichnis im Dateisystem, in welchem SSSD den Kerberos Replay-Cache ablegt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -589,7 +574,7 @@ msgstr ""
 "Ort für den Replay-Zwischenspeicher ist."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -598,12 +583,12 @@ msgstr ""
 "(__LIBKRB5_DEFAULTS__, falls nicht konfiguriert)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -611,14 +596,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -628,17 +613,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -654,7 +639,7 @@ msgstr ""
 "ihrem Benutzernamen ohne auch eine Domain anzugeben."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -667,8 +652,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -676,12 +661,12 @@ msgid "Default: not set"
 msgstr "Voreinstellung: nicht gesetzt"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -691,7 +676,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -700,22 +685,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -723,12 +708,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -736,61 +721,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -798,12 +783,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -811,24 +796,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 #, fuzzy
 #| msgid ""
 #| "Please refer to the <quote>dns_discovery_domain</quote> parameter in the "
@@ -845,12 +830,12 @@ msgstr ""
 "citerefentry> beim Parameter »dns_discovery_domain«."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -859,7 +844,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -867,58 +852,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -929,7 +914,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -947,20 +932,20 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Voreinstellung: Nicht gesetzt"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 #, fuzzy
 #| msgid "ipa_server_mode (boolean)"
 msgid "implicit_pac_responder (boolean)"
 msgstr "ipa_server_mode (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -968,14 +953,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 #, fuzzy
 #| msgid "ad_enable_gc (boolean)"
 msgid "core_dumpable (boolean)"
 msgstr "ad_enable_gc (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -983,28 +968,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "ipa_automount_location (string)"
 msgid "passkey_verification (string)"
 msgstr "ipa_automount_location (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "ipa_automount_location (string)"
 msgid "user_verification (boolean)"
 msgstr "ipa_automount_location (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1012,7 +997,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -1043,12 +1028,12 @@ msgstr ""
 "verwendet. <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "DIENSTABSCHNITTE"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1061,22 +1046,22 @@ msgstr ""
 "Abschnitt zum Beispiel <quote>[nss]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Allgemeine Optionen zum Konfigurieren von Diensten"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Diese Optionen können zur Konfiguration jedes Dienstes benutzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1092,17 +1077,17 @@ msgstr ""
 "Begrenzung in der »limit.conf« sein."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "Voreinstellung: 8192 (oder die »harte« Begrenzung der »limit.conf«)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1112,19 +1097,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 60, KCM: 300"
 msgstr "Voreinstellung: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1135,14 +1120,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1150,46 +1135,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Voreinstellung: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "offline_timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1198,64 +1183,64 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "Voreinstellung: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "offline_timeout (integer)"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "Voreinstellung: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1267,30 +1252,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Voreinstellung: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "NSS-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1298,12 +1283,12 @@ msgstr ""
 "benutzt werden"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1312,17 +1297,17 @@ msgstr ""
 "über alle Nutzer) zwischenspeichern?"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Voreinstellung: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1334,7 +1319,7 @@ msgstr ""
 "werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1351,7 +1336,7 @@ msgstr ""
 "Zwischenspeicheraktualisierung zu warten."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1364,17 +1349,17 @@ msgstr ""
 "Sekunden senken. (0 schaltet diese Funktionalität aus.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Voreinstellung: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1386,17 +1371,17 @@ msgstr ""
 "Backend erneut gefragt wird)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Voreinstellung: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1404,17 +1389,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1423,7 +1408,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1432,17 +1417,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Voreinstellung: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1450,12 +1435,12 @@ msgstr ""
 "setzen Sie diese Option auf »false«."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1464,7 +1449,7 @@ msgstr ""
 "es nicht explizit durch den Datenanbieter der Domain angegeben wurde."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1472,7 +1457,7 @@ msgstr ""
 "»override_homedir«."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1482,25 +1467,25 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Beispiel: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 "Voreinstellung: nicht gesetzt (kein Ersetzen nicht gesetzter Home-"
 "Verzeichnisse)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1511,19 +1496,19 @@ msgstr ""
 "entweder im Abschnitt [nss] oder für jede Domain gesetzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "Voreinstellung: nicht gesetzt (SSSD wird den von LDAP erhaltenen Wert "
 "benutzen)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1531,12 +1516,12 @@ msgstr ""
 "Reihenfolge der Auswertung ist:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr "1. Falls die Shell in »/etc/shells« vorhanden ist, wird sie benutzt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1545,7 +1530,7 @@ msgstr ""
 "shells« steht, wird der Wert des Parameters »shell_fallback« verwendet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1554,12 +1539,12 @@ msgstr ""
 "steht, wird eine Nicht-Login-Shell benutzt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1567,13 +1552,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 "Eine leere Zeichenkette als Shell wird, so wie sie ist, an Libc übergeben."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1582,28 +1567,28 @@ msgstr ""
 "Fall einer neu installierten Shell ein Neustart von SSSD nötig ist."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 "Voreinstellung: nicht gesetzt. Die Benutzer-Shell wird automatisch verwendet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "ersetzt jedwede Instanz dieser Shells durch die aus »shell_fallback«."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1611,17 +1596,17 @@ msgstr ""
 "auf dem Rechner installiert ist."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Voreinstellung: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1631,7 +1616,7 @@ msgstr ""
 "jede Domain gesetzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1641,12 +1626,12 @@ msgstr ""
 "Vernünftiges, üblicherweise /bin/sh, ersetzt.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1655,43 +1640,43 @@ msgstr ""
 "gültig erachtet wird."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "enum_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "enum_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1699,27 +1684,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "enum_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1727,21 +1712,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Voreinstellung: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "enum_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1749,14 +1734,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "enum_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1765,12 +1750,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1781,38 +1766,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>permit</quote>"
 msgid "Default: <quote>*</quote>"
 msgstr "Voreinstellung: »permit«"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 #, fuzzy
 #| msgid "This option can also be set per-domain."
 msgid ""
@@ -1821,7 +1806,7 @@ msgid ""
 msgstr "Diese Option kann auch pro Domain gesetzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1830,12 +1815,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "PAM-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -1844,12 +1829,12 @@ msgstr ""
 "Authentication Module« (PAM) einzurichten."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -1859,17 +1844,17 @@ msgstr ""
 "erfolgreichen Anmeldung)?"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Voreinstellung: 0 (unbegrenzt)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -1878,12 +1863,12 @@ msgstr ""
 "Authentifizierungsanbieter offline ist?"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -1893,7 +1878,7 @@ msgstr ""
 "Anmeldeversuch möglich ist."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1905,17 +1890,17 @@ msgstr ""
 "Authentifizierung reaktivieren."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Voreinstellung: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -1924,45 +1909,45 @@ msgstr ""
 "angezeigt werden. Je höher die Zahl, desto mehr Nachrichten werden angezeigt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "Derzeit unterstützt SSSD folgende Werte:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: keine Nachricht anzeigen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: nur wichtige Nachrichten anzeigen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: nur informative Nachrichten anzeigen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: alle Nachrichten und Debug-Informationen anzeigen"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Voreinstellung: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "ad_access_filter (string)"
 msgid "pam_response_filter (string)"
 msgstr "ad_access_filter (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1971,51 +1956,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2026,23 +2011,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2054,7 +2039,7 @@ msgstr ""
 "den neusten Informationen erfolgt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2068,17 +2053,17 @@ msgstr ""
 "viele Abfragen der Identitätsanbieter zu vermeiden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "zeigt N Tage vor Ablauf des Passworts eine Warnung an."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2089,7 +2074,7 @@ msgstr ""
 "SSSD keine Warnung anzeigen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2099,7 +2084,7 @@ msgstr ""
 "automatisch angezeigt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2108,17 +2093,18 @@ msgstr ""
 "emphasis> für eine bestimmte Domain außer Kraft gesetzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Voreinstellung: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2128,75 +2114,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Voreinstellung: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2204,19 +2190,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2224,48 +2210,48 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 #, fuzzy
 #| msgid "ldap_chpass_update_last_change (bool)"
 msgid "pam_passkey_auth (bool)"
 msgstr "ldap_chpass_update_last_change (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Voreinstellung: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Voreinstellung: False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2273,36 +2259,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "ipa_automount_location (string)"
 msgid "pam_cert_verification (string)"
 msgstr "ipa_automount_location (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2312,7 +2298,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, fuzzy, no-wrap
 #| msgid ""
 #| "fallback_homedir = /home/%u\n"
@@ -2325,63 +2311,63 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "pam_id_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "simple_allow_users (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "simple_allow_users (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2389,7 +2375,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2401,63 +2387,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2465,12 +2451,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2481,7 +2467,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2489,7 +2475,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2497,7 +2483,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2506,47 +2492,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2555,17 +2541,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 #, fuzzy
 #| msgid "Comma separated list of users who are allowed to log in."
 msgid ""
@@ -2574,13 +2560,13 @@ msgid ""
 msgstr "Durch Kommata getrennte Liste von Benutzern, die sich anmelden dürfen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2588,7 +2574,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, fuzzy, no-wrap
 #| msgid ""
 #| "fallback_homedir = /home/%u\n"
@@ -2601,22 +2587,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2624,19 +2610,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2644,7 +2630,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2659,7 +2645,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2667,45 +2653,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2713,7 +2699,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2721,7 +2707,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 #, fuzzy
 #| msgid "Default: not set (no substitution for unset home directories)"
 msgid "Default: not set (use of authentication indicators is not required)"
@@ -2730,12 +2716,12 @@ msgstr ""
 "Verzeichnisse)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "Sudo-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2753,12 +2739,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -2768,12 +2754,12 @@ msgstr ""
 "nicht."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2783,23 +2769,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "AUTOFS-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 "Diese Optionen können zum Konfigurieren des Dienstes »autofs« benutzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2810,23 +2796,23 @@ msgstr ""
 "nicht existierende), bevor das Backend erneut befragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "SSH-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 "Diese Optionen können zum Konfigurieren des SSH-Dienstes benutzt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -2835,12 +2821,12 @@ msgstr ""
 "»known_hosts« zusammengemischt werden oder nicht."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -2849,17 +2835,17 @@ msgstr ""
 "»known_hosts« behalten wird, bevor seine Rechnerschlüssel abgefragt werden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "Voreinstellung: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2868,12 +2854,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2883,7 +2869,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2891,7 +2877,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2900,38 +2886,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "PAC-Responder-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2942,7 +2928,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2953,7 +2939,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -2962,18 +2948,18 @@ msgstr ""
 "diesen Gruppen hinzugefügt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 "Diese Optionen können zur Konfiguration des PAC-Responders verwendet werden."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2984,7 +2970,7 @@ msgstr ""
 "beim Starten zu UIDs aufgelöst."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 #, fuzzy
 #| msgid ""
 #| "Default: 0 (only the root user is allowed to access the PAC responder)"
@@ -2996,14 +2982,14 @@ msgstr ""
 "Responder gestattet.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "Voreinstellung: 0 (Nur dem Benutzer Root ist der Zugriff auf den PAC-"
 "Responder gestattet.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 #, fuzzy
 #| msgid ""
 #| "Please note that although the UID 0 is used as the default it will be "
@@ -3022,7 +3008,7 @@ msgstr ""
 "der Liste der erlaubten UIDs auch die 0 hinzufügen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3035,26 +3021,26 @@ msgstr ""
 "der Liste der erlaubten UIDs auch die 0 hinzufügen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "ldap_schema (string)"
 msgid "pac_check (string)"
 msgstr "ldap_schema (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3065,24 +3051,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3090,24 +3076,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3119,7 +3105,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3130,41 +3116,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -3177,19 +3163,19 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3199,66 +3185,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3266,17 +3252,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3284,7 +3270,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3293,65 +3279,65 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "exclude_users (string)"
 msgstr "simple_deny_users (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No users excluded."
 msgstr "Voreinstellung: leer, d.h., dass »ldap_uri« benutzt wird"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "simple_deny_groups (string)"
 msgid "exclude_groups (string)"
 msgstr "simple_deny_groups (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No groups excluded."
 msgstr "Voreinstellung: leer, d.h., dass »ldap_uri« benutzt wird"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "DOMAIN-ABSCHNITTE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3361,12 +3347,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3375,14 +3361,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3391,31 +3377,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3424,7 +3410,7 @@ msgstr ""
 "enthält, der jenseits dieser Beschränkungen liegt, wird er ignoriert."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3437,7 +3423,7 @@ msgstr ""
 "werden jene, die im Bereich liegen, wie erwartet gemeldet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3446,17 +3432,17 @@ msgstr ""
 "den Zwischenspeicher und nicht nur ihre Rückgabe über Name oder ID."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Voreinstellung: 1 für »min_id«, 0 (keine Beschränkung) für »max_id«"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3465,36 +3451,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = Benutzer und Gruppen werden aufgezählt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = keine Aufzählungen für diese Domain"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Voreinstellung: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3508,7 +3494,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3518,7 +3504,7 @@ msgstr ""
 "Ergebnisse zurück."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3533,7 +3519,7 @@ msgstr ""
 "benutzten »id_provider«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -3542,7 +3528,7 @@ msgstr ""
 "insbesondere in großen Umgebungen, nicht empfohlen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3550,32 +3536,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Alle entdeckten vertrauenswürdigen Domains werden aufgezählt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Keine der entdeckten vertrauenswürdigen Domains wird aufgezählt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3589,12 +3575,12 @@ msgstr ""
 "Domains aktivieren."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -3603,7 +3589,7 @@ msgstr ""
 "soll, bevor das Backend erneut abgefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3621,17 +3607,17 @@ msgstr ""
 "wurden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Voreinstellung: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -3640,19 +3626,19 @@ msgstr ""
 "betrachten soll, bevor das Backend erneut abgefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "Voreinstellung: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -3661,12 +3647,12 @@ msgstr ""
 "betrachten soll, bevor das Backend erneut abgefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -3675,12 +3661,12 @@ msgstr ""
 "betrachten soll, bevor das Backend erneut abgefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -3689,24 +3675,24 @@ msgstr ""
 "betrachten soll, bevor das Backend erneut abgefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -3715,12 +3701,12 @@ msgstr ""
 "bevor das Backend erneut abgefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -3730,36 +3716,36 @@ msgstr ""
 "wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -3769,7 +3755,7 @@ msgstr ""
 "abgelaufenen oder beinahe abgelaufenen Daten aktualisiert werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3778,19 +3764,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 "Sie können in Betracht ziehen, diesen Wert auf 3/4 * entry_cache_timeout zu "
 "setzen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3802,18 +3788,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "Voreinstellung: 0 (deaktiviert)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3824,7 +3810,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3833,12 +3819,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3850,19 +3836,19 @@ msgstr ""
 "gespeichert zu werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3875,17 +3861,17 @@ msgstr ""
 "Parameters muss größer oder gleich »offline_credentials_expiration« sein."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Voreinstellung: 0 (unbegrenzt)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3898,17 +3884,17 @@ msgstr ""
 "Authentifizierungsanbieter konfiguriert werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Voreinstellung: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -3916,12 +3902,12 @@ msgstr ""
 "werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3929,7 +3915,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3940,8 +3926,8 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 #, fuzzy
 #| msgid ""
 #| "<quote>ipa</quote>: FreeIPA and Red Hat Enterprise Identity Management "
@@ -3959,8 +3945,8 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3972,12 +3958,12 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -3987,7 +3973,7 @@ msgstr ""
 "Benutzers, der an NSS gemeldet wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4001,7 +3987,7 @@ msgstr ""
 "test@LOCAL</command> würde ihn hingegen finden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4013,24 +3999,24 @@ msgstr ""
 "nicht voll qualifizierter Name angefragt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr "gibt beim Nachschlagen der Gruppe nicht die Gruppenmitglieder zurück."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4042,7 +4028,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4050,23 +4036,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4075,7 +4061,7 @@ msgstr ""
 "Authentifizierungsanbieter werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4086,7 +4072,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4098,19 +4084,19 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 "»proxy« zur Weitergabe der Authentifizierung an irgendein anderes PAM-Ziel"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "»none« deaktiviert explizit die Authentifizierung."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4119,12 +4105,12 @@ msgstr ""
 "mit Authentifizierungsanfragen umgehen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4135,7 +4121,7 @@ msgstr ""
 "Backends enthalten sind). Interne Spezialanbieter sind:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4144,12 +4130,12 @@ msgstr ""
 "für eine lokale Domain."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "»deny« verweigert dem Zugriff immer."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4162,7 +4148,7 @@ msgstr ""
 "simple</refentrytitle> <manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4170,22 +4156,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Voreinstellung: »permit«"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4194,7 +4180,7 @@ msgstr ""
 "Folgende Anbieter von Passwortänderungen werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4202,7 +4188,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4214,19 +4200,19 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 "»proxy« zur Weitergabe der Passwortänderung an irgendein anderes PAM-Ziel"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "»none« verbietet explizit Passwortänderungen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4235,19 +4221,19 @@ msgstr ""
 "kann mit Passwortänderungsanfragen umgehen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "der für diese Domain benutzte Sudo-Anbieter. Folgende Sudo-Anbieter werden "
 "unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4258,7 +4244,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4267,7 +4253,7 @@ msgstr ""
 "Vorgabeeinstellungen für IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4276,19 +4262,19 @@ msgstr ""
 "Vorgabeeinstellungen für AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "»none« deaktiviert explizit Sudo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "Voreinstellung: Falls gesetzt, wird der Wert von »id_provider« benutzt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4305,7 +4291,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4314,12 +4300,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4330,7 +4316,7 @@ msgstr ""
 "Zugriffsanbieter beendet hat. Folgende SELinux-Anbieter werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4342,12 +4328,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr "»none« verbietet explizit das Abholen von SELinux-Einstellungen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4356,12 +4342,12 @@ msgstr ""
 "kann SELinux-Ladeanfragen handhaben."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4371,7 +4357,7 @@ msgstr ""
 "werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4383,7 +4369,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4392,17 +4378,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "»none« deaktiviert explizit das Abholen von Subdomains."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4410,30 +4396,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -4441,7 +4427,7 @@ msgstr ""
 "»autofs« werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4453,7 +4439,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4465,7 +4451,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4473,17 +4459,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "»none« deaktiviert explizit »autofs«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -4492,7 +4478,7 @@ msgstr ""
 "wird. Folgende Anbieter von »hostid« werden unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4504,31 +4490,31 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "»none« deaktiviert explizit »hostid«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4536,7 +4522,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4545,12 +4531,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4565,7 +4551,7 @@ msgstr ""
 "(NetBIOS-) Namen der Domain entsprechen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 #, fuzzy
 #| msgid ""
 #| "Default for the AD and IPA provider: <quote>(((?P&lt;domain&gt;[^\\\\]+)\\"
@@ -4581,17 +4567,17 @@ msgstr ""
 "P&lt;Name&gt;[^@\\\\]+)$))« "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "Benutzername"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "Benutzername@Domain.Name"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 #, fuzzy
 #| msgid ""
 #| "Default for the AD and IPA provider: <quote>(((?P&lt;domain&gt;[^\\\\]+)\\"
@@ -4609,12 +4595,12 @@ msgstr ""
 "P&lt;Name&gt;[^@\\\\]+)$))« "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "Domain\\Benutzername"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -4624,7 +4610,7 @@ msgstr ""
 "Windows-Domains zu ermöglichen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4634,17 +4620,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Voreinstellung: »%1$s@%2$s«"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -4652,93 +4638,98 @@ msgstr ""
 "ermöglicht es, die bei DNS-Abfragen zu bevorzugende Adressfamilie zu wählen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "unterstützte Werte:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: versucht die IPv4- und, falls dies fehlschlägt, die IPv6-Adresse "
 "nachzuschlagen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr "ipv4_only: versucht, nur Rechnernamen zu IPv4-Adressen aufzulösen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: versucht die IPv6- und, falls dies fehlschlägt, die IPv4-Adresse "
 "nachzuschlagen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr "ipv6_only: versucht, nur Rechnernamen zu IPv6-Adressen aufzulösen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Voreinstellung: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Voreinstellung: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Voreinstellung: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4747,14 +4738,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4762,7 +4753,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4770,17 +4761,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Voreinstellung: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -4789,19 +4780,19 @@ msgstr ""
 "DNS-Dienstabfrage an."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr "Voreinstellung: Der Domain-Teil des Rechnernamens wird benutzt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "pam_id_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4809,59 +4800,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Voreinstellung: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "überschreibt die Haupt-GID mit der angegebenen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4869,14 +4860,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -4889,17 +4880,17 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4907,128 +4898,128 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_search_timeout (integer)"
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "ldap_network_timeout (integer)"
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "ldap_connection_expire_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout (integer)"
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 #, fuzzy
 #| msgid "ldap_krb5_ticket_lifetime (integer)"
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "ldap_enumeration_search_timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_expire_timeout (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5036,27 +5027,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "flacher (NetBIOS-) Name einer Subdomain"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5071,7 +5062,7 @@ msgstr ""
 "verwendet werden.  <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5079,17 +5070,17 @@ msgstr ""
 "überschrieben werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Voreinstellung: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
@@ -5097,12 +5088,12 @@ msgstr ""
 "Kennzeichnungen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5111,19 +5102,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5131,14 +5122,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy (string)"
 msgstr "ldap_pwd_policy (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5150,7 +5141,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5162,7 +5153,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5170,44 +5161,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_pwd_policy (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5216,7 +5207,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5227,7 +5218,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5235,38 +5226,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: cn"
 msgid "Default: match"
 msgstr "Voreinstellung: cn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5275,24 +5266,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5302,14 +5293,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5317,21 +5308,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5339,7 +5330,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5348,7 +5339,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5357,7 +5348,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -5369,17 +5360,17 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "das Proxy-Ziel, an das PAM weiterleitet"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 #, fuzzy
 #| msgid ""
 #| "Default: not set by default, you have to take an existing pam "
@@ -5394,12 +5385,12 @@ msgstr ""
 "hinzufügen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -5410,12 +5401,12 @@ msgstr ""
 "»_nss_$(libName)_$(function)«, zum Beispiel »_nss_files_getpwent«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -5423,12 +5414,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -5442,12 +5433,12 @@ msgstr ""
 "veranlassen, die ID im Zwischenspeicher nachzuschlagen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -5455,7 +5446,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -5464,12 +5455,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5486,7 +5477,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5494,17 +5485,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5513,7 +5504,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5523,7 +5514,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5543,12 +5534,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5559,69 +5550,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5634,7 +5625,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5642,7 +5633,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5651,55 +5642,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5708,17 +5699,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5726,26 +5717,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5754,17 +5745,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5774,7 +5765,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5783,59 +5774,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5844,7 +5835,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5852,18 +5843,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5871,39 +5873,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -5916,7 +5918,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5925,7 +5927,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5933,12 +5935,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[sssd]\n"
@@ -6016,7 +6018,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6025,7 +6027,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6033,7 +6035,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6044,7 +6046,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6055,7 +6057,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -6263,7 +6265,7 @@ msgstr ""
 "rfc/rfc2254.txt spezifiziert, sein."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Beispiele:"
@@ -6750,7 +6752,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "Voreinstellung: 900 (15 Minuten)"
 
@@ -7069,7 +7071,7 @@ msgstr ""
 "die <command>sssd</command> erkennen wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -7084,11 +7086,19 @@ msgstr "ldap_tls_cacertdir (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "gibt den Pfad eines Verzeichnisses an, das Zertifikate von "
 "Zertifizierungstellen in separaten individuellen Dateien enthält. Die "
@@ -7097,33 +7107,33 @@ msgstr ""
 "Erstellen der korrekten Namen verwendet werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 "gibt die Datei an, die das Zertifikat für den Schlüssel des Clients enthält."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "gibt die Datei an, die den Schlüssel des Clients enthält."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -7131,12 +7141,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 #, fuzzy
 #| msgid ""
 #| "Specifies that the id_provider connection must also use <systemitem "
@@ -7150,12 +7160,12 @@ msgstr ""
 "class=\"protocol\">tls</systemitem> benutzen muss, um den Kanal abzusichern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -7167,19 +7177,19 @@ msgstr ""
 "verlassen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "Derzeit unterstützt diese Funktionalität nur das Abbilden von Active-"
 "Directory-ObjectSIDs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -7198,24 +7208,24 @@ msgstr ""
 "Abbildung von IDs wählen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr "Voreinstellung: nicht gesetzt (beide Optionen sind auf 0 gesetzt)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -7226,12 +7236,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -7244,7 +7254,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -7256,17 +7266,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "Voreinstellung Rechner/MeinRechner@BEREICH"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -7277,17 +7287,17 @@ msgstr ""
 "»ldap_sasl_authid« ebenfalls den Realm enthält, wird diese Option ignoriert."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "Voreinstellung: der Wert von »krb5_realm«"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -7297,34 +7307,34 @@ msgstr ""
 "Bind in eine kanonische Form zu bringen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Voreinstellung: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Voreinstellung: Keytab des Systems, normalerweise <filename>/etc/krb5."
 "keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -7332,28 +7342,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Voreinstellung: 86400 (24 Stunden)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -7372,7 +7382,7 @@ msgstr ""
 "Weitere Informationen finden Sie im Abschnitt »DIENSTSUCHE«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -7383,7 +7393,7 @@ msgstr ""
 "Protokoll angeben. Falls keine gefunden werden, weicht es auf _tcp aus."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -7395,29 +7405,29 @@ msgstr ""
 "migrieren."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 "Voreinstellung: Systemvoreinstellungen, siehe <filename>/etc/krb5.conf</"
 "filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -7427,12 +7437,12 @@ msgstr ""
 "Kerberos >= 1.7 verfügbar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -7448,7 +7458,7 @@ msgstr ""
 "manvolnum> </citerefentry> einrichten."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -7459,12 +7469,12 @@ msgstr ""
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -7473,7 +7483,7 @@ msgstr ""
 "Passworts abgeschätzt werden soll. Die folgenden Werte sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -7482,7 +7492,7 @@ msgstr ""
 "kann keine Server-seitigen Passwortregelwerke deaktivieren."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 #, fuzzy
 #| msgid ""
 #| "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
@@ -7499,7 +7509,7 @@ msgstr ""
 "manvolnum></citerefentry>, um abzuschätzen, ob das Passwort erloschen ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -7511,7 +7521,7 @@ msgstr ""
 "Passwort geändert wurde."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
@@ -7521,17 +7531,17 @@ msgstr ""
 "festgelegten Regel."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr "gibt an, ob automatische Verweisverfolgung aktiviert werden soll."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -7540,7 +7550,7 @@ msgstr ""
 "mit OpenLDAP Version 2.4.13 oder höher kompiliert wurde."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 #, fuzzy
 #| msgid ""
 #| "Chasing referrals may incur a performance penalty in environments that "
@@ -7564,28 +7574,28 @@ msgstr ""
 "merkliche Leistungsverbesserung bringen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "gibt an, welcher Dienstname bei aktivierter Dienstsuche benutzt werden soll."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Voreinstellung: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -7594,17 +7604,17 @@ msgstr ""
 "soll, der Passwortänderungen bei aktivierter Dienstsuche ermöglicht."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr "Voreinstellung: nicht gesetzt, d.h. Dienstsuche ist deaktiviert"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
@@ -7613,7 +7623,7 @@ msgstr ""
 "Passwortänderung mit Unix-Zeit geändert wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -7622,12 +7632,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -7657,12 +7667,12 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Beispiel:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7674,7 +7684,7 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
@@ -7683,7 +7693,7 @@ msgstr ""
 "beschränkt, deren employeeType-Attribut auf »admin« gesetzt ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -7692,17 +7702,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "Voreinstellung: leer"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -7711,7 +7721,7 @@ msgstr ""
 "Zugriffssteuerungsattribute aktiviert werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -7722,12 +7732,12 @@ msgstr ""
 "einem geeigneten Fehlercode zurückweisen, wenn das Passwort korrekt ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Die folgenden Werte sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -7736,7 +7746,7 @@ msgstr ""
 "»ldap_user_shadow_expire«, um zu bestimmen, ob das Konto abgelaufen ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -7749,7 +7759,7 @@ msgstr ""
 "gewährt. Außerdem wird die Ablaufzeit des Kontos geprüft."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -7760,7 +7770,7 @@ msgstr ""
 "Zugriff erlaubt wird oder nicht."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -7773,7 +7783,7 @@ msgstr ""
 "Zugriff gewährt wird. Falls diese Attribute fehlen, wird Zugriff erteilt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -7784,24 +7794,24 @@ msgstr ""
 "»ldap_account_expire_policy« funktioniert."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "durch Kommata getrennte Liste von Zugriffssteuerungsoptionen. Folgende Werte "
 "sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis>: verwendet »ldap_access_filter«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7811,14 +7821,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7831,12 +7841,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>expire</emphasis>: verwendet »ldap_account_expire_policy«."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -7846,38 +7856,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -7886,33 +7897,33 @@ msgstr ""
 "»authorizedService«, um zu bestimmen, ob Zugriff gewährt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis>: verwendet das Attribut »host«, um zu bestimmen, "
 "ob Zugriff gewährt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Voreinstellung: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -7921,12 +7932,12 @@ msgstr ""
 "mehr als einmal benutzt wird."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7935,22 +7946,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -7959,12 +7970,12 @@ msgstr ""
 "folgenden Optionen sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr "<emphasis>never</emphasis>: Alias werden nie dereferenziert."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -7974,7 +7985,7 @@ msgstr ""
 "Suche."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -7983,7 +7994,7 @@ msgstr ""
 "der Suche dereferenziert."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -7992,7 +8003,7 @@ msgstr ""
 "Orten des Basisobjekts der Suche dereferenziert."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -8001,12 +8012,12 @@ msgstr ""
 "<emphasis>never</emphasis> gehandhabt.)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -8015,7 +8026,7 @@ msgstr ""
 "beizubehalten, die das Schema RFC2307 benutzen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -8033,7 +8044,7 @@ msgstr ""
 "getpw*() oder initgroups() abzurufen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -8044,70 +8055,88 @@ msgstr ""
 "die lokalen Benutzer um zusätzliche LDAP-Gruppen erweitert werden."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "debug_level (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "debug_level (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 #, fuzzy
 #| msgid "Default: 0 (disabled)"
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "Voreinstellung: 0 (deaktiviert)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "ldap_id_mapping (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_id_mapping (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (Ganzzahl)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -8121,12 +8150,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "SUDO-OPTIONEN"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -8137,12 +8166,12 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
@@ -8152,7 +8181,7 @@ msgstr ""
 "heruntergeladen werden)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -8161,24 +8190,24 @@ msgstr ""
 "emphasis> sein."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "Voreinstellung: 21600 (6 Stunden)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -8186,7 +8215,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
@@ -8195,7 +8224,7 @@ msgstr ""
 "das Attribut »modifyTimestamp« benutzt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -8205,21 +8234,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_idmap_range_size (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -8227,7 +8256,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -8235,17 +8264,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
@@ -8255,12 +8284,12 @@ msgstr ""
 "Netzwerkadressen und Rechnernamen)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -8269,7 +8298,7 @@ msgstr ""
 "Domain-Namen, die zum Filtern der Regeln benutzt werden sollen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
@@ -8278,8 +8307,8 @@ msgstr ""
 "voll qualifizierten Domain-Namen automatisch herauszufinden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -8288,17 +8317,17 @@ msgstr ""
 "emphasis> ist, hat diese Option keine Auswirkungen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "Voreinstellung: nicht angegeben"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -8307,7 +8336,7 @@ msgstr ""
 "Netzwerkadressen, die zum Filtern der Regeln benutzt werden sollen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -8316,12 +8345,12 @@ msgstr ""
 "herauszufinden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
@@ -8330,12 +8359,12 @@ msgstr ""
 "eine Netzgruppe im Attribut »sudoHost« enthält."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
@@ -8344,14 +8373,14 @@ msgstr ""
 "einen Platzhalter im Attribut »sudoHost« enthält."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -8364,59 +8393,59 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "AUTOFS-OPTIONEN"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "Der Name der Automount-Master-Abbildung in LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "Voreinstellung: auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "ERWEITERTE OPTIONEN"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -8425,22 +8454,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -8449,14 +8478,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "BEISPIEL"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -8467,7 +8496,7 @@ msgstr ""
 "gesetzt ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8480,27 +8509,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8516,13 +8545,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "ANMERKUNGEN"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -10903,7 +10932,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (Boolesch)"
 
@@ -10918,7 +10947,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -10940,12 +10969,12 @@ msgstr ""
 "Konfigurationsdatei migrieren."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (Ganzzahl)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -10974,12 +11003,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Voreinstellung: 1200 (Sekunden)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -11007,17 +11036,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -11025,19 +11054,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 #, fuzzy
 #| msgid "dyndns_iface (string)"
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_iface (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -11045,7 +11074,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -11080,7 +11109,7 @@ msgstr ""
 "gefundenen als Sicherungsserver."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (Ganzzahl)"
 
@@ -11096,12 +11125,12 @@ msgstr ""
 "Diese Option ist optional und nur anwendbar, wenn »dyndns_update« »true« ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -11121,7 +11150,7 @@ msgstr ""
 "Weiterleitungsdatensätze ändern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -11133,12 +11162,12 @@ msgid "Default: False (disabled)"
 msgstr "Voreinstellung: False (deaktiviert)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -11147,48 +11176,48 @@ msgstr ""
 "DNS-Server verwenden soll"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Voreinstellung: False (lässt Nsupdate das Protokoll auswählen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -11362,26 +11391,26 @@ msgstr ""
 "zu verwenden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -11400,7 +11429,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "Voreinstellung: 5 (Sekunden)"
 
@@ -12164,18 +12193,16 @@ msgstr "ad_access_filter (Zeichenkette)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
-"Diese Option gibt Zugriffskontrollfilter für LDAP an, die auf den Benutzer "
-"passen müssen, damit ihm Zugriff gewährt werden kann. Bitte beachten Sie, "
-"dass die Option <quote>access_provider</quote> explizit auf <quote>ad</"
-"quote> gesetzt werden muss, damit sie wirksam ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -12188,7 +12215,7 @@ msgstr ""
 "<quote>FOREST</quote> sein oder auch weggelassen werden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -12202,7 +12229,7 @@ msgstr ""
 "<quote>NAME</quote> angegeben ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
@@ -12211,7 +12238,7 @@ msgstr ""
 "so wie es auch in Suchmaschinen üblich ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -12224,7 +12251,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -12238,7 +12265,7 @@ msgstr ""
 "der erste verwendet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -12256,24 +12283,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -12287,7 +12314,7 @@ msgstr ""
 "dem LDAP-Port des aktuellen Servers."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -12302,12 +12329,12 @@ msgstr ""
 "können."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (Zeichenkette)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -12321,7 +12348,7 @@ msgstr ""
 "auf <quote>ad</quote> gesetzt werden muss, damit sie wirksam ist."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -12330,7 +12357,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -12339,7 +12366,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -12349,21 +12376,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -12373,7 +12400,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -12388,12 +12415,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr "Für diese Option werden drei Werte unterstützt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
@@ -12401,14 +12428,14 @@ msgstr ""
 "deren Anwendung erzwungen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 "enforcing: GPO-basierte Zugriffskontrollregeln werden sowohl ausgewertet als "
 "auch deren Anwendung erzwungen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -12420,22 +12447,22 @@ msgstr ""
 "verweigert werden würde, wenn die Option auf »enforcing« gesetzt wäre."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "Voreinstellung: permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -12446,7 +12473,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -12454,80 +12481,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "all users are allowed"
 msgstr "Die folgenden Werte sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "only users in allow-rules are allowed"
 msgstr "Die folgenden Werte sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "no users are allowed"
 msgstr "Die folgenden Werte sind erlaubt:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -12537,12 +12564,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -12550,12 +12577,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -12571,14 +12598,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -12586,7 +12613,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12598,42 +12625,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -12649,7 +12676,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -12657,7 +12684,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -12665,7 +12692,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12677,22 +12704,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -12708,7 +12735,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -12716,7 +12743,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -12724,7 +12751,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12736,22 +12763,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -12766,14 +12793,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -12781,7 +12808,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12793,23 +12820,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -12825,14 +12852,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -12840,7 +12867,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -12851,19 +12878,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -12871,7 +12898,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12883,29 +12910,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -12913,12 +12940,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -12931,52 +12958,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -12984,17 +13011,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -13004,17 +13031,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -13023,12 +13050,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -13039,14 +13066,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 #, fuzzy
 #| msgid "ldap_sudo_include_netgroups (boolean)"
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ldap_sudo_include_netgroups (Boolesch)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -13057,7 +13084,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -13072,7 +13099,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -13084,7 +13111,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -13102,19 +13129,19 @@ msgstr ""
 "»dyndns_iface« angegeben wurde."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "Voreinstellung: 3600 (Sekunden)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -13124,7 +13151,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -13136,7 +13163,7 @@ msgstr ""
 "Optionen von AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -13160,7 +13187,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -13172,7 +13199,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -13183,7 +13210,7 @@ msgstr ""
 "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -13193,7 +13220,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -13793,76 +13820,89 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr "EXIT-STATUS"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 #, fuzzy
 #| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
 msgstr "NSS-Konfigurationsoptionen"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -15937,7 +15977,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -15974,8 +16014,59 @@ msgstr ""
 "sucht in der SSSD-Domain nach <replaceable>DOMAIN</replaceable> öffentlichen "
 "Schlüsseln für den Rechner."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-R</option>,<option>--no-remove</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-R</option>,<option>--no-remove</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:115
 #, fuzzy
 #| msgid ""
 #| "In case of success, an exit value of 0 is returned. Otherwise, 1 is "
@@ -20029,14 +20120,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -20664,6 +20754,28 @@ msgstr ""
 "werden sollen. Diese Funktionalität ist mit MIT-Kerberos 1.7 und neueren "
 "Versionen verfügbar."
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (Ganzzahl)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Anzahl der Versuche, die ein Dienst unternehmen sollte, um sich erneut zu "
+#~ "verbinden, bevor er aufgibt, falls ein Datenanbieter abgestürzt ist oder "
+#~ "neu startet."
+
+#~ msgid ""
+#~ "This option specifies LDAP access control filter that the user must match "
+#~ "in order to be allowed access. Please note that the "
+#~ "<quote>access_provider</quote> option must be explicitly set to "
+#~ "<quote>ad</quote> in order for this option to have an effect."
+#~ msgstr ""
+#~ "Diese Option gibt Zugriffskontrollfilter für LDAP an, die auf den "
+#~ "Benutzer passen müssen, damit ihm Zugriff gewährt werden kann. Bitte "
+#~ "beachten Sie, dass die Option <quote>access_provider</quote> explizit auf "
+#~ "<quote>ad</quote> gesetzt werden muss, damit sie wirksam ist."
+
 #, fuzzy
 #~| msgid "This option is not available in IPA provider."
 #~ msgid "This option is ignored for the files provider."
@@ -21086,9 +21198,6 @@ msgstr ""
 #~ "Verzeichnis selbst und der Mail-Warteschlange des Benutzers entfernt. "
 #~ "Dies setzt die Konfiguration außer Kraft."
 
-#~ msgid "<option>-R</option>,<option>--no-remove</option>"
-#~ msgstr "<option>-R</option>,<option>--no-remove</option>"
-
 #~ msgid ""
 #~ "Files in the user's home directory will NOT be removed along with the "
 #~ "home directory itself and the user's mail spool. Overrides the "
diff --git a/src/man/po/es.po b/src/man/po/es.po
index 17a8b9534bf..40d7eac93f2 100644
--- a/src/man/po/es.po
+++ b/src/man/po/es.po
@@ -18,7 +18,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2021-10-27 15:05+0000\n"
 "Last-Translator: Emilio Herrera <ehespinosa57@gmail.com>\n"
 "Language-Team: Spanish <https://translate.fedoraproject.org/projects/sssd/"
@@ -287,13 +287,13 @@ msgstr ""
 "habilitado para el registro de la depuración SSSD esta opción se ignora."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Predeterminado: true"
 
@@ -313,11 +313,11 @@ msgstr ""
 "se ignora."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Predeterminado: false"
@@ -357,8 +357,8 @@ msgstr ""
 "configuración no tiene efecto para otro tipo de registros)."
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -391,8 +391,8 @@ msgstr ""
 "Advierta que después de tres pulsaciones perdidas el servicio se terminará."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Predeterminado: 10"
 
@@ -431,12 +431,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Servicios soportados: nss, pam <phrase condition=\"with_sudo\">, sudo</"
 "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
@@ -445,7 +451,7 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
@@ -455,33 +461,13 @@ msgstr ""
 "deshabilitados y el administrador debe habilitar aquellos que permita que se "
 "usen para ejecución: \"systemctl enable sssd-@service@.socket\".  </phrase>"
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (entero)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Cantidad de intentos de reconexión de los servicios ante una eventual caída "
-"de datos del  proveedor, o de reiniciarse antes de abandonar"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Predeterminado: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "dominios"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -498,12 +484,12 @@ msgstr ""
 "\"/\" está prohibido."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -512,7 +498,7 @@ msgstr ""
 "contiene el nombre de usuario y el dominio en estos componentes."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -523,12 +509,12 @@ msgstr ""
 "las SECCIONES DOMINIO para mas información sobre estas expresiones regulares."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -540,33 +526,33 @@ msgstr ""
 "dominio."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "nombre de usuario"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 "nombre de dominio como se especifica en el fichero de configuración SSSD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -576,7 +562,7 @@ msgstr ""
 "medio de IPA de confianza."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -585,7 +571,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
@@ -594,12 +580,12 @@ msgstr ""
 "SECCIONES DOMINIO para más información sobre esta opción."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr "monitor_resolv_conf (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -608,12 +594,12 @@ msgstr ""
 "cuando necesita actualizar su interfaz de resolución DNS interno."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -624,7 +610,7 @@ msgstr ""
 "no puede ser usado."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -635,7 +621,7 @@ msgstr ""
 "'false' "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -644,7 +630,7 @@ msgstr ""
 "en el resto de las plataformas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -654,12 +640,12 @@ msgstr ""
 "utilizada siempre."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -668,7 +654,7 @@ msgstr ""
 "reproducción de cache de Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -678,7 +664,7 @@ msgstr ""
 "de respuesta."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -687,12 +673,12 @@ msgstr ""
 "tiempo. (si no se configura __LIBKRB5_DEFAULTS__)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr "usuario (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -700,14 +686,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -717,17 +703,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr "Por defecto: no ajustado, los procesos correrán como root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -743,7 +729,7 @@ msgstr ""
 "usuario sin dar también un nombre de dominio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 #, fuzzy
 #| msgid ""
 #| "Please note that if this option is set all users from the primary domain "
@@ -775,8 +761,8 @@ msgstr ""
 "cuando se use la opción default_domain_suffix."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -784,12 +770,12 @@ msgid "Default: not set"
 msgstr "Predeterminado: no definido"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr "override_space (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -805,7 +791,7 @@ msgstr ""
 "predeterminado en el shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -818,22 +804,22 @@ msgstr ""
 "no modificado pero en general el resultado de la búsqueda es indefinido."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Por defecto: no ajustado (los espacios no serán reemplazados)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr "certificate_verification (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr "no_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -844,12 +830,12 @@ msgstr ""
 "certificado no son alcanzables por el cliente."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr "soft_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -861,12 +847,12 @@ msgstr ""
 "puede ser alcanzado."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr "ocsp_dgst"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
@@ -875,39 +861,39 @@ msgstr ""
 "petición OCSP. Los valores permitidos son:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr "sha1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr "sha256"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr "sha384"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr "sha512"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 "Predeterminado: sha1 (para permitir la compatibilidad con el contestador que "
 "cumple el RFC50190)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr "no_verification"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
@@ -916,12 +902,12 @@ msgstr ""
 "para pruebas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr "partial_chain"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -933,12 +919,12 @@ msgstr ""
 "que puede no estar autofirmado."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr "ocsp_default_responder=URL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -949,12 +935,12 @@ msgstr ""
 "OCSP por defecto e.g.  http://example.com:80/ocsp."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr "ocsp_default_responder_signing_cert=NAME"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
@@ -963,12 +949,12 @@ msgstr ""
 "estar disponibles en el fichero PEM indicado por pam_cert_db_path."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr "crl_file=/PATH/TO/CRL/FILE"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -981,12 +967,12 @@ msgstr ""
 "<manvolnum>1ssl</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 #, fuzzy
 #| msgid ""
 #| "If a Certificate Revocation List (CRL)  is expired ignore the CRL checks "
@@ -1004,7 +990,7 @@ msgstr ""
 "linea y la CRL no puede ser renovada."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -1015,23 +1001,23 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr "Se informa de las opciones desconocidas pero son ignoradas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 "Por defecto: no fijado, i.e. no restringe la verificación de certificado"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr "disable_netlink (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
@@ -1040,7 +1026,7 @@ msgstr ""
 "rutas, direcciones, enlaces y disparar ciertas acciones."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
@@ -1050,17 +1036,17 @@ msgstr ""
 "'true'"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr "Predeterminado: false (se detectan los cambio de enlace de red)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr "enable_files_domain (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
@@ -1070,12 +1056,12 @@ msgstr ""
 "configurado."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr "domain_resolution_order"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -1092,7 +1078,7 @@ msgstr ""
 "serán buscados en un orden aleatorio por cada dominio padre."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 #, fuzzy
 #| msgid ""
 #| "Please, note that when this option is set the output format of all "
@@ -1139,20 +1125,20 @@ msgstr ""
 "casos donde los nombres de usuarios se deben compartir entre dominios."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Por defecto: No definido"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 #, fuzzy
 #| msgid "ad_gpo_implicit_deny (boolean)"
 msgid "implicit_pac_responder (boolean)"
 msgstr "ad_gpo_implicit_deny (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -1160,14 +1146,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 #, fuzzy
 #| msgid "ad_gpo_ignore_unreadable (boolean)"
 msgid "core_dumpable (boolean)"
 msgstr "ad_gpo_ignore_unreadable (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1175,28 +1161,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "certificate_verification (string)"
 msgid "passkey_verification (string)"
 msgstr "certificate_verification (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "certificate_verification (string)"
 msgid "user_verification (boolean)"
 msgstr "certificate_verification (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1204,7 +1190,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 #, fuzzy
 #| msgid ""
 #| "With this parameter the certificate verification can be tuned with a "
@@ -1237,12 +1223,12 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "SECCIONES DE SERVICIOS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1255,22 +1241,22 @@ msgstr ""
 "sección sería <quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Opciones de configuración de servicios generales"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Estas opciones pueden usarse para configurar cualquier servicio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1285,17 +1271,17 @@ msgstr ""
 "valor más bajo de este o de limite “hard” en limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "Por defecto: 8192 (o limite “hard” en limits.conf)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1310,17 +1296,17 @@ msgstr ""
 "configura un valor más bajo será ajustado a 10 segundos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr "Predeterminado: 60, KCM: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1338,7 +1324,7 @@ msgstr ""
 "nuevo intervalo se calcula mediante lo siguiente:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
@@ -1347,7 +1333,7 @@ msgstr ""
 "offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1359,46 +1345,46 @@ msgstr ""
 "segundos antes del próximo reintento."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Predeterminado: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "offline_timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1407,66 +1393,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "Predeterminado: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "offline_timeout + random_offset"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout + random_offset"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 #, fuzzy
 #| msgid "offline_timeout + random_offset"
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "offline_timeout + random_offset"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "Predeterminado: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr "responder_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1485,18 +1471,18 @@ msgstr ""
 "los servicios activados son socket o D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Predeterminado: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr "cache_first"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
@@ -1505,12 +1491,12 @@ msgstr ""
 "de consultar a los Proveedores de Datos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "Opciones de configuración de NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1518,12 +1504,12 @@ msgstr ""
 "Switch (NSS)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1532,17 +1518,17 @@ msgstr ""
 "sobre todos los usuarios)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Predeterminado: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1553,7 +1539,7 @@ msgstr ""
 "valor de entry_cache_timeout para el dominio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1569,7 +1555,7 @@ msgstr ""
 "actualización del cache."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1582,17 +1568,17 @@ msgstr ""
 "segundos. (0 deshabilita esta función)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Predeterminado: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1603,17 +1589,17 @@ msgstr ""
 "entradas no existentes) antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Predeterminado: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr "local_negative_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1624,17 +1610,17 @@ msgstr ""
 "otra vez. Fijando la opción a 0 deshabilita esta característica."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr "Por defecto: 14400 (4 horas)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1648,7 +1634,7 @@ msgstr ""
 "usuario (UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1661,17 +1647,17 @@ msgstr ""
 "filtrado mantendrá los usuarios miembros del listado posterior."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Predeterminado: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1679,12 +1665,12 @@ msgstr ""
 "opción a false."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1693,7 +1679,7 @@ msgstr ""
 "especificado una explícitamente por el proveedor de datos del dominio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1701,7 +1687,7 @@ msgstr ""
 "override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1711,24 +1697,24 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "ejemplo: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 "Por defecto: no fijado (sin sustitución para los directorios home no fijados)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1739,17 +1725,17 @@ msgstr ""
 "la sección [nss] o por dominio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr "Por defecto: no fijado (SSSD usará el valor recuperado desde LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1757,12 +1743,12 @@ msgstr ""
 "evaluación es:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr "1. Si el shell está presente en <quote>/etc/shells</quote>, se usa."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1771,7 +1757,7 @@ msgstr ""
 "shells</quote>, usa el valor del parámetro shell_fallback."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1780,12 +1766,12 @@ msgstr ""
 "shells</quote>, se usará un shell de no acceso."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr "Se puede usar el comodín (*) para permitir cualquier shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1796,12 +1782,12 @@ msgstr ""
 "los shells permitidos en allowed_shells estuviera llena."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "Una cadena vacía para el shell se pasa como-es a libc."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1811,27 +1797,27 @@ msgstr ""
 "una nueva shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr "Por defecto: No fijado. La shell del usuario se usa automáticamente."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "Reemplaza cualquier instancia de estos shells con shell_fallback"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1839,17 +1825,17 @@ msgstr ""
 "máquina."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Predeterminado: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1859,7 +1845,7 @@ msgstr ""
 "o por dominio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1869,12 +1855,12 @@ msgstr ""
 "normalmente /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1883,14 +1869,14 @@ msgstr ""
 "considerada válida."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "enum_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
@@ -1899,7 +1885,7 @@ msgstr ""
 "cache serán validos. Fijando esta opción o cero deshabilita la memoria cache."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
@@ -1909,8 +1895,8 @@ msgstr ""
 "pruebas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
@@ -1919,14 +1905,14 @@ msgstr ""
 "las aplicaciones clientes no usaran la memoria cache rápida."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "enum_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 #, fuzzy
 #| msgid ""
 #| "Specifies time in seconds for which records in the in-memory cache will "
@@ -1940,13 +1926,13 @@ msgstr ""
 "cache serán validos. Fijando esta opción o cero deshabilita la memoria cache."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr "Predeterminado: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 #, fuzzy
 #| msgid ""
 #| "WARNING: Disabling the in-memory cache will have significant negative "
@@ -1960,14 +1946,14 @@ msgstr ""
 "pruebas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "enum_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 #, fuzzy
 #| msgid ""
 #| "Specifies time in seconds for which records in the in-memory cache will "
@@ -1981,21 +1967,21 @@ msgstr ""
 "cache serán validos. Fijando esta opción o cero deshabilita la memoria cache."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Predeterminado: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "enum_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 #, fuzzy
 #| msgid ""
 #| "Specifies time in seconds for which records in the in-memory cache will "
@@ -2009,14 +1995,14 @@ msgstr ""
 "cache serán validos. Fijando esta opción o cero deshabilita la memoria cache."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "enum_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 #, fuzzy
 #| msgid ""
 #| "Specifies time in seconds for which records in the in-memory cache will "
@@ -2031,12 +2017,12 @@ msgstr ""
 "cache serán validos. Fijando esta opción o cero deshabilita la memoria cache."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -2054,7 +2040,7 @@ msgstr ""
 "predeterminados."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
@@ -2063,17 +2049,17 @@ msgstr ""
 "opción InfoPipe si no está fijada para el contestador NSS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr "Por defecto: no ajustada, retroceder a opción InfoPipe"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr "pwfield (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
@@ -2082,14 +2068,14 @@ msgstr ""
 "para el campo <quote>password</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>permit</quote>"
 msgid "Default: <quote>*</quote>"
 msgstr "Predeterminado: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 #, fuzzy
 #| msgid "This option can also be set per-domain."
 msgid ""
@@ -2098,7 +2084,7 @@ msgid ""
 msgstr "Esta opción puede ser también fijada por dominio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 #, fuzzy
 #| msgid ""
 #| "Default: <quote>*</quote> (remote domains)  or <quote>x</quote> (the "
@@ -2113,12 +2099,12 @@ msgstr ""
 "ficheros de dominio)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "Opciones de configuración PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -2127,12 +2113,12 @@ msgstr ""
 "Authentication Module (PAM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -2141,17 +2127,17 @@ msgstr ""
 "los accesos escondidos (en días desde el último login en línea con éxito)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Predeterminado: 0 (Sin límite)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -2160,12 +2146,12 @@ msgstr ""
 "login fallados están permitidos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -2175,7 +2161,7 @@ msgstr ""
 "intento de login sea posible."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -2186,17 +2172,17 @@ msgstr ""
 "éxito puede habilitar otra vez la autenticación fuera de línea."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Predeterminado: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -2205,46 +2191,46 @@ msgstr ""
 "autenticación. Cuanto mayor sea el número de mensajes más aparecen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "Actualmente sssd soporta los siguientes valores:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: no mostrar ningún mensaje"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: mostrar sólo mensajes importantes"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: mostrar mensajes informativos"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: mostrar todos los mensajes e información de "
 "depuración"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Predeterminado: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "pam_response_filter (integer)"
 msgid "pam_response_filter (string)"
 msgstr "pam_response_filter (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2257,7 +2243,7 @@ msgstr ""
 "variables de entorno que deberían ser fijadas por pam_sss."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
@@ -2266,37 +2252,37 @@ msgstr ""
 "pam_verbosity esta opción permite filtrar otra clase de respuestas también."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr "ENV"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr "No envía ninguna variable de entorno a ningún servicio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr "ENV:var_name"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr "No envía la variable de entorno var_name a  ningún servicio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr "ENV:var_name:service"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr "No envía la variable de entorno var_name al servicio."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -2305,7 +2291,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2316,25 +2302,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 #, fuzzy
 #| msgid "Example: ENV:KRB5CCNAME:sudo-i"
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr "Ejemplo: ENV:KRB5CCNAME:sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2346,7 +2332,7 @@ msgstr ""
 "información más actual."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2360,17 +2346,17 @@ msgstr ""
 "proveedor de identidad."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "Mostrar una advertencia N días antes que la contraseña caduque."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2381,7 +2367,7 @@ msgstr ""
 "información desaparece, sssd no podrá mostrar un aviso."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2391,7 +2377,7 @@ msgstr ""
 "automáticamente."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2400,17 +2386,18 @@ msgstr ""
 "<emphasis>pwd_expiration_warning</emphasis> para un dominio concreto."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Predeterminado: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2425,12 +2412,12 @@ msgstr ""
 "nombres de usuarios se resuelven a UIDs en el arranque."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr "Por defecto: Todos los usuarios se consideran de confianza por defecto"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
@@ -2439,12 +2426,12 @@ msgstr ""
 "aunque no está en la la lista pam_trusted_users."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
@@ -2453,13 +2440,13 @@ msgstr ""
 "accesibles hasta para los usuarios en los que no se confíe."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 "Hay definidos dos valores especiales para la opción pam_public_domains:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
@@ -2467,7 +2454,7 @@ msgstr ""
 "dominios en el contestador PAM.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2476,19 +2463,19 @@ msgstr ""
 "dominios PAM en el contestador.)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Predeterminado: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
@@ -2497,7 +2484,7 @@ msgstr ""
 "mensaje predeterminado 'Permiso denegado'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
@@ -2507,7 +2494,7 @@ msgstr ""
 "mensajes e información de depuración)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2517,12 +2504,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr "pam_account_locked_message (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
@@ -2531,7 +2518,7 @@ msgstr ""
 "por defecto 'Permiso denegado'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2541,48 +2528,48 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 #, fuzzy
 #| msgid "pam_cert_auth (bool)"
 msgid "pam_passkey_auth (bool)"
 msgstr "pam_cert_auth (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Predeterminado: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Por defecto: False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr "pam_cert_auth (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2593,22 +2580,22 @@ msgstr ""
 "de autenticación esta opción está deshabilitada por defecto."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr "pam_cert_db_path (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr "Predeterminado:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 #, fuzzy
 #| msgid ""
 #| "/etc/sssd/pki/sssd_auth_ca_db.pem (OpenSSL version, path to a file with "
@@ -2621,14 +2608,14 @@ msgstr ""
 "certificados CA de confianza en formato PEM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "certificate_verification (string)"
 msgid "pam_cert_verification (string)"
 msgstr "certificate_verification (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 #, fuzzy
 #| msgid ""
 #| "With this parameter the certificate verification can be tuned with a "
@@ -2646,7 +2633,7 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, fuzzy, no-wrap
 #| msgid ""
 #| "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2659,31 +2646,31 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr "p11_child_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr "Cuantos segundos esperará pam_sss wait para que p11_child finalice."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "p11_child_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "p11_child_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 #, fuzzy
 #| msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgid ""
@@ -2691,12 +2678,12 @@ msgid ""
 msgstr "Cuantos segundos esperará pam_sss wait para que p11_child finalice."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr "pam_app_services (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
@@ -2705,14 +2692,14 @@ msgstr ""
 "tipo <quote>application</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "pam_p11_allowed_services (integer)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "pam_p11_allowed_services (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
@@ -2721,7 +2708,7 @@ msgstr ""
 "permitidos usar Smartcards."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2731,7 +2718,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2751,65 +2738,65 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 "Predeterminado: el conjunto predeterminado de nombres de servicio PAM "
 "incluye:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr "gnome-screensaver"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2820,12 +2807,12 @@ msgstr ""
 "inserte la Smartcard."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr "p11_uri (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2843,7 +2830,7 @@ msgstr ""
 "específico."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, fuzzy, no-wrap
 #| msgid ""
 #| "p11_uri = library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2856,7 +2843,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, fuzzy, no-wrap
 #| msgid ""
 #| "p11_uri = library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2869,7 +2856,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2882,47 +2869,47 @@ msgstr ""
 "GnuTLS 'p11tool' con e.g. '--list-all' mostrará PKCS#11 URIs también."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2931,19 +2918,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 #, fuzzy
 #| msgid "pam_app_services (string)"
 msgid "pam_gssapi_services"
 msgstr "pam_app_services (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 #, fuzzy
 #| msgid "Comma separated list of users who are allowed to log in."
 msgid ""
@@ -2952,13 +2939,13 @@ msgid ""
 msgstr "Lista separada por comas de usuarios a los está permitido el acceso."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2966,7 +2953,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, fuzzy, no-wrap
 #| msgid ""
 #| "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2979,22 +2966,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Ejemplo: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -3002,19 +2989,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -3022,7 +3009,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -3037,7 +3024,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -3045,45 +3032,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, fuzzy, no-wrap
 #| msgid ""
 #| "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -3096,7 +3083,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -3104,7 +3091,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 #, fuzzy
 #| msgid "Default: not set (no substitution for unset home directories)"
 msgid "Default: not set (use of authentication indicators is not required)"
@@ -3112,12 +3099,12 @@ msgstr ""
 "Por defecto: no fijado (sin sustitución para los directorios home no fijados)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "SUDO opciones de configuración"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -3135,12 +3122,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -3149,12 +3136,12 @@ msgstr ""
 "entradas de sudoers dependientes del tiempo."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr "sudo_threshold (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -3170,22 +3157,22 @@ msgstr ""
 "comando."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "Opciones de configuración AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr "Estas opciones pueden ser usadas para configurar el servicio autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -3196,22 +3183,22 @@ msgstr ""
 "existentes) antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "Opciones de configuración SSH"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr "Estas opciones se pueden usar para configurar el servicio SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -3220,12 +3207,12 @@ msgstr ""
 "known_host. "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -3234,17 +3221,17 @@ msgstr ""
 "después de que se hayan pedido sus claves de host."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "Por defecto: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr "ssh_use_certificate_keys (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -3258,12 +3245,12 @@ msgstr ""
 "manvolnum> </citerefentry> for details."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr "ssh_use_certificate_matching_rules (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -3278,7 +3265,7 @@ msgstr ""
 "de reglas que coincidan y mapeen. Todas las demás reglas serán ignoradas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -3286,7 +3273,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -3295,26 +3282,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr "ca_db (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
@@ -3324,12 +3311,12 @@ msgstr ""
 "públicas ssh de ellos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "Opciones de configuración del respondedor PAC"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -3347,7 +3334,7 @@ msgstr ""
 "se hacen algunas de las siguientes operaciones:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -3363,7 +3350,7 @@ msgstr ""
 "predeterminado, pero se puede sustituir con el parámetro default_shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3372,17 +3359,17 @@ msgstr ""
 "a esos grupos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr "Estas opciones pueden ser usadas para configurar el respondedor PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3392,7 +3379,7 @@ msgstr ""
 "usuario que tiene el acceso permitido al respondedor PAC."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 #, fuzzy
 #| msgid ""
 #| "Default: 0 (only the root user is allowed to access the PAC responder)"
@@ -3404,14 +3391,14 @@ msgstr ""
 "respondedor PAC)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "Por defecto: 0 (sólo el usuario root tiene permitido el acceso al "
 "respondedor PAC)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 #, fuzzy
 #| msgid ""
 #| "Please note that although the UID 0 is used as the default it will be "
@@ -3430,7 +3417,7 @@ msgstr ""
 "lista de UIDs permitidas también."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3443,12 +3430,12 @@ msgstr ""
 "lista de UIDs permitidas también."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr "pac_lifetime (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
@@ -3458,14 +3445,14 @@ msgstr ""
 "usuario."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "ldap_schema (string)"
 msgid "pac_check (string)"
 msgstr "ldap_schema (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3476,24 +3463,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3501,24 +3488,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3530,7 +3517,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3541,41 +3528,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -3588,19 +3575,19 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr "Opciones de configuración de la grabación de sesión"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3616,32 +3603,32 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr "Se pueden usar estas opciones para configurar la grabación de sesión."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr "scope (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr "\"none\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr "NO se grabaron usuarios."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr "\"some\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
@@ -3650,17 +3637,17 @@ msgstr ""
 "replaceable> y<replaceable>groups</replaceable> son grabados."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr "\"all\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr "Se graban todos los usuarios."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3669,17 +3656,17 @@ msgstr ""
 "grabación: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr "Predeterminado: \"none\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr "users (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3691,17 +3678,17 @@ msgstr ""
 "mayúsculas/minúsculas, etc."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr "Predeterminado: Vacío. No hay usuarios coincidentes."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr "groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3713,7 +3700,7 @@ msgstr ""
 "minúsculas, etc."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3726,65 +3713,65 @@ msgstr ""
 "pertenece el usuario."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr "Predeterminado: Vacío. No empareja grupos."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "users (string)"
 msgid "exclude_users (string)"
 msgstr "users (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 #, fuzzy
 #| msgid "Default: Empty. Matches no users."
 msgid "Default: Empty. No users excluded."
 msgstr "Predeterminado: Vacío. No hay usuarios coincidentes."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "groups (string)"
 msgid "exclude_groups (string)"
 msgstr "groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 #, fuzzy
 #| msgid "Default: Empty. Matches no groups."
 msgid "Default: Empty. No groups excluded."
 msgstr "Predeterminado: Vacío. No empareja grupos."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "SECCIONES DE DOMINIO"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3794,12 +3781,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr "domain_type (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3812,7 +3799,7 @@ msgstr ""
 "disponibles para las interfaces y utilidades de sistema operativo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
@@ -3821,7 +3808,7 @@ msgstr ""
 "<quote>application</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3834,7 +3821,7 @@ msgstr ""
 "manvolnum> </citerefentry>) y el contestador PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
@@ -3843,7 +3830,7 @@ msgstr ""
 "<quote>id_provider=ldap</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
@@ -3852,17 +3839,17 @@ msgstr ""
 "<quote>Dominios aplicación</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr "Predeterminado: posix"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id, max_id (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3871,7 +3858,7 @@ msgstr ""
 "está fuera de estos límites, ésta es ignorada."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3884,7 +3871,7 @@ msgstr ""
 "reportados como en espera."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3893,17 +3880,17 @@ msgstr ""
 "devolviéndolas por nombre o ID."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Predeterminado: 1 para min_id, 0 (sin límite) para max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerar (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3916,22 +3903,22 @@ msgstr ""
 "Este parámetros puede tener uno de los siguientes valores:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = Usuarios y grupos son enumerados"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = Sin enumeraciones para este dominio"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Predeterminado: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
@@ -3940,14 +3927,14 @@ msgstr ""
 "entradas de usuario y grupo del servidor remoto."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 #, fuzzy
 #| msgid ""
 #| "Note: Enabling enumeration has a moderate performance impact on SSSD "
@@ -3982,7 +3969,7 @@ msgstr ""
 "guardián interno."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3992,7 +3979,7 @@ msgstr ""
 "completen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -4006,7 +3993,7 @@ msgstr ""
 "específico id_provider en uso."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -4015,7 +4002,7 @@ msgstr ""
 "especialmente en entornos grandes."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -4023,32 +4010,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Se enumerarán todos los dominios de confianza descubiertos"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr "No serán enumerados dominios de confianza descubiertos"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -4061,12 +4048,12 @@ msgstr ""
 "enumeración solo para estos dominios de confianza."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -4075,7 +4062,7 @@ msgstr ""
 "volver a consultar al backend"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -4093,17 +4080,17 @@ msgstr ""
 "están en la caché."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Predeterminado: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -4112,19 +4099,19 @@ msgstr ""
 "antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "Por defecto: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -4133,12 +4120,12 @@ msgstr ""
 "antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -4147,12 +4134,12 @@ msgstr ""
 "válidas antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -4161,24 +4148,24 @@ msgstr ""
 "antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -4187,12 +4174,12 @@ msgstr ""
 "preguntar al backend otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -4201,12 +4188,12 @@ msgstr ""
 "automontaje válidos antes de preguntar al punto final otra vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -4215,24 +4202,24 @@ msgstr ""
 "cuanto guardar en caché la clave de host."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -4242,7 +4229,7 @@ msgstr ""
 "expirados o a punto de hacerlo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -4255,18 +4242,18 @@ msgstr ""
 "login), tanto la entrada usuario y la membresia de grupo son actualizados."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 "Esta opción se hereda automáticamente para todos los dominios de confianza."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr "Usted puede considerar ajustar este valor a 3/4 * entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -4278,18 +4265,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "Predeterminado: 0 (deshabilitado)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -4300,7 +4287,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -4309,12 +4296,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr "cache_credentials_minimal_first_factor_length (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -4326,7 +4313,7 @@ msgstr ""
 "SHA512 en el caché."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
@@ -4336,12 +4323,12 @@ msgstr ""
 "bruta."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -4354,17 +4341,17 @@ msgstr ""
 "grande o igual que offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Predeterminado: 0 (ilimitado)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -4377,17 +4364,17 @@ msgstr ""
 "configurar un proveedor de autorización para el backend."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Por defecto: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -4395,12 +4382,12 @@ msgstr ""
 "soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr "<quote>proxy</quote>: Soporta un proveedor NSS heredado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4412,7 +4399,7 @@ msgstr ""
 "grupos locales en SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4423,8 +4410,8 @@ msgstr ""
 "información sobre la configuración de LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 #, fuzzy
 #| msgid ""
 #| "<quote>ipa</quote>: FreeIPA and Red Hat Enterprise Identity Management "
@@ -4442,8 +4429,8 @@ msgstr ""
 "configuración de FreeIPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4455,12 +4442,12 @@ msgstr ""
 "Directory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4470,7 +4457,7 @@ msgstr ""
 "NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4484,7 +4471,7 @@ msgstr ""
 "command> lo haría."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4496,24 +4483,24 @@ msgstr ""
 "cualificado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr "No devuelve miembros de grupo para búsquedas de grupo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4532,7 +4519,7 @@ msgstr ""
 "devolver el grupo pedido como si estuviera vacío."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4543,23 +4530,23 @@ msgstr ""
 "especialmente para grupos que contienen muchos miembros."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4568,7 +4555,7 @@ msgstr ""
 "autenticación soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4579,7 +4566,7 @@ msgstr ""
 "citerefentry> para más información sobre la configuración LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4590,7 +4577,7 @@ msgstr ""
 "citerefentry> para más información sobre la configuración de Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
@@ -4598,12 +4585,12 @@ msgstr ""
 "objetivo PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> deshabilita la autenticación explícitamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4612,12 +4599,12 @@ msgstr ""
 "manejar las peticiones de autenticación."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4628,7 +4615,7 @@ msgstr ""
 "proveedores especiales internos son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4637,12 +4624,12 @@ msgstr ""
 "sólo permitido para un dominio local."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> siempre niega el acceso."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4655,7 +4642,7 @@ msgstr ""
 "configuración del módulo de acceso sencillo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4667,23 +4654,23 @@ msgstr ""
 "Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 "<quote>proxy</quote> para transmitir control de acceso a otro módulo PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Predeterminado: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4692,7 +4679,7 @@ msgstr ""
 "el dominio. Los proveedores de cambio de passweord soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4704,7 +4691,7 @@ msgstr ""
 "configuración de LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4715,7 +4702,7 @@ msgstr ""
 "citerefentry> para más información sobre configurar Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
@@ -4723,13 +4710,13 @@ msgstr ""
 "otros objetivos PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 "<quote>none</quote> deniega explícitamente los cambios en la contraseña."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4738,18 +4725,18 @@ msgstr ""
 "puede manejar las peticiones de cambio de password."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "El proveedor SUDO usado por el dominio. Los proveedores SUDO soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4760,7 +4747,7 @@ msgstr ""
 "citerefentry> para más información sobre la configuración LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4769,7 +4756,7 @@ msgstr ""
 "predeterminados IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4778,19 +4765,19 @@ msgstr ""
 "predeterminados AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote>deshabilita SUDO explícitamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "Por defecto: el valor de <quote>id_provider</quote> se usa si está fijado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4807,7 +4794,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4821,12 +4808,12 @@ msgstr ""
 "desea usar sudo cn SSSD mas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4837,7 +4824,7 @@ msgstr ""
 "finalice. Los proveedores selinux soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4849,14 +4836,14 @@ msgstr ""
 "IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 "<quote>none</quote> deshabilita ir a buscar los ajustes selinux "
 "explícitamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4865,12 +4852,12 @@ msgstr ""
 "manejar las peticiones de carga selinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4880,7 +4867,7 @@ msgstr ""
 "soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4892,7 +4879,7 @@ msgstr ""
 "configuración de IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4905,18 +4892,18 @@ msgstr ""
 "configuración del proveedor AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 "<quote>none</quote> deshabilita el buscador de subdominios explícitamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr "session_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4928,14 +4915,14 @@ msgstr ""
 "de sesiones soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 "<quote>ipa</quote> para permitir llevar a cabo tareas relacionadas con la "
 "sesión de usuario."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
@@ -4943,7 +4930,7 @@ msgstr ""
 "de usuario."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
@@ -4952,12 +4939,12 @@ msgstr ""
 "llevar a cabo tareas relacionadas con la sesión de usuario."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -4965,7 +4952,7 @@ msgstr ""
 "son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4977,7 +4964,7 @@ msgstr ""
 "LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4989,7 +4976,7 @@ msgstr ""
 "IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5001,17 +4988,17 @@ msgstr ""
 "proveedor AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> deshabilita autofs explícitamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -5020,7 +5007,7 @@ msgstr ""
 "proveedores de hostid soportados son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -5032,31 +5019,31 @@ msgstr ""
 "configuración de IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> deshabilita hostid explícitamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -5064,7 +5051,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -5073,12 +5060,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -5093,7 +5080,7 @@ msgstr ""
 "dominios Active Directory, el nombre plano (NetBIOS) del dominio."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 #, fuzzy
 #| msgid ""
 #| "Default for the AD and IPA provider: <quote>(((?P&lt;domain&gt;[^\\\\]+)\\"
@@ -5110,17 +5097,17 @@ msgstr ""
 "nombres de usuario:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "nombre de usuario"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "username@domain.name"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 #, fuzzy
 #| msgid ""
 #| "Default for the AD and IPA provider: <quote>(((?P&lt;domain&gt;[^\\\\]+)\\"
@@ -5139,12 +5126,12 @@ msgstr ""
 "nombres de usuario:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "dominio/nombre_de_usuario"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -5154,7 +5141,7 @@ msgstr ""
 "dominios Windows."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -5164,17 +5151,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Predeterminado: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -5183,57 +5170,57 @@ msgstr ""
 "a usar cuando se lleven a cabo búsquedas DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Valores soportados:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr "ipv4_first: Intenta buscar dirección IPv4, si falla, intenta IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr "ipv4_only: Sólo intenta resolver nombres de host a direccones IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr "ipv6_first: Intenta buscar dirección IPv6, si falla, intenta IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr "ipv6_only: Sólo intenta resolver nombres de host a direccones IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Predeterminado: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
@@ -5242,32 +5229,37 @@ msgstr ""
 "información sobre la resolución del servicio."
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Predeterminado: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Predeterminado: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -5280,14 +5272,14 @@ msgstr ""
 "trabajando en modo offline."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -5295,7 +5287,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -5303,17 +5295,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Predeterminado: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -5322,20 +5314,20 @@ msgstr ""
 "de dominio de la pregunta al descubridor de servicio DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 "Predeterminado: Utilizar la parte del dominio del nombre de host del equipo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "p11_wait_for_card_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -5343,61 +5335,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Predeterminado: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "Anula el valor primario GID con el especificado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 "Distingue mayúsculas y minúsculas. Este valor es invalido para el proveedor "
 "AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr "No sensible a mayúsculas minúsculas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -5409,14 +5401,14 @@ msgstr ""
 "protocolo) están en minúsculas en la salida."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 #, fuzzy
 #| msgid ""
 #| "The available options are: <placeholder type=\"variablelist\" id=\"0\"/>"
@@ -5427,17 +5419,17 @@ msgstr ""
 "Las opciones disponibles son: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr "Predeterminado: True (False para proveedor AD)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -5449,61 +5441,61 @@ msgstr ""
 "siguientes opciones:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_search_timeout (integer)"
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "ldap_network_timeout (integer)"
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "ldap_connection_expire_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout"
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
@@ -5512,71 +5504,71 @@ msgstr ""
 "explícitamente ldap_krb5_keytab)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 #, fuzzy
 #| msgid "ldap_krb5_ticket_lifetime (integer)"
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "ldap_enumeration_search_timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_expire_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 #, fuzzy
 #| msgid "auto_private_groups (string)"
 msgid "auto_private_groups"
 msgstr "auto_private_groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 #, fuzzy
 #| msgid "Case insensitive."
 msgid "case_sensitive"
 msgstr "No sensible a mayúsculas minúsculas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5586,27 +5578,27 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr "Aviso: Esta opción solo trabaja con el proveedor IPA y AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "flat (NetBIOS) nombre de un subdominio."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5622,7 +5614,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5630,17 +5622,17 @@ msgstr ""
 "emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Por defecto: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
@@ -5648,12 +5640,12 @@ msgstr ""
 "este dominio."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr "cached_auth_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5666,7 +5658,7 @@ msgstr ""
 "incorrectas, SSSD cae de nuevo a la autenticación en linea."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
@@ -5676,12 +5668,12 @@ msgstr ""
 "confianza."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr "El valor especial 0 implica que esta función está deshabilitada."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5692,14 +5684,14 @@ msgstr ""
 "gestionar <quote>initgroups.</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy (string)"
 msgstr "ldap_pwd_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5711,7 +5703,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5723,7 +5715,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5731,46 +5723,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_pwd_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 #, fuzzy
 #| msgid "gdm-smartcard"
 msgid "Smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5779,7 +5771,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5790,7 +5782,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5798,31 +5790,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: mail"
 msgid "Default: match"
 msgstr "Predeterminado: mail"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr "auto_private_groups (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr "true"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
@@ -5831,7 +5823,7 @@ msgstr ""
 "usuario.  El número GID se ignora en este caso."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5844,12 +5836,12 @@ msgstr ""
 "unicidad den el espacio de ID."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr "false"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
@@ -5858,12 +5850,12 @@ msgstr ""
 "a un  objeto grupo en las base de datos LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr "hybrid"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5878,7 +5870,7 @@ msgstr ""
 "grupo, el GID primario del usuario se resuelve al de ese objeto grupo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
@@ -5887,7 +5879,7 @@ msgstr ""
 "una entrada de grupo, de otro modo el GID simplemente no se puede resolver."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5898,7 +5890,7 @@ msgstr ""
 "también desea retener los grupos privados existentes del usuario."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -5907,7 +5899,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
@@ -5916,7 +5908,7 @@ msgstr ""
 "POSIX IDs asignados y True para subdominios que usan mapeo de ID automático."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5926,7 +5918,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5938,7 +5930,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5952,7 +5944,7 @@ msgstr ""
 "type=\"programlisting\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -5964,17 +5956,17 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "El proxy de destino PAM próximo a."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 #, fuzzy
 #| msgid ""
 #| "Default: not set by default, you have to take an existing pam "
@@ -5988,12 +5980,12 @@ msgstr ""
 "pam existente o crear una nueva y añadir el nombre de servicio aquí."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -6004,12 +5996,12 @@ msgstr ""
 "_nss_$(libName)_$(function), por ejemplo _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -6017,12 +6009,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -6036,12 +6028,12 @@ msgstr ""
 "razones de rendimiento."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr "proxy_max_children (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -6053,7 +6045,7 @@ msgstr ""
 "son encoladas."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -6062,12 +6054,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr "Dominios de aplicaciones"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -6096,7 +6088,7 @@ msgstr ""
 "que opcionalmente herede ajustes de un dominio SSSD tradicional."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -6108,17 +6100,17 @@ msgstr ""
 "establecido correctamente."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr "Parámetros de dominio de aplicación"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr "inherit_from (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -6131,7 +6123,7 @@ msgstr ""
 "<quote>hermano</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -6146,7 +6138,7 @@ msgstr ""
 "cache y hace al atributo phone alcanzable a través del interfaz D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6180,12 +6172,12 @@ msgstr ""
 "ldap_user_extra_attrs = phone:telephoneNumber\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr "SECCIÓN DE DOMINIO DE CONFIANZA"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -6202,57 +6194,57 @@ msgstr ""
 "soportadas en la sección de dominio de confianza son:"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr "ldap_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr "ldap_user_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr "ldap_group_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr "ldap_netgroup_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr "ldap_service_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr "ldap_sasl_mech,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr "ad_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr "ad_backup_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr "ad_site,"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr "use_fully_qualified_names"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
@@ -6261,12 +6253,12 @@ msgstr ""
 "página de manual."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr "SECCIÓN DE MAPEO DEL CERTIFICADO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -6288,7 +6280,7 @@ msgstr ""
 "usan autenticación PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -6300,7 +6292,7 @@ msgstr ""
 "citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -6314,12 +6306,12 @@ msgstr ""
 "opciones:"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr "matchrule (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
@@ -6328,7 +6320,7 @@ msgstr ""
 "procesados, los demás son ignorados."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
@@ -6337,17 +6329,17 @@ msgstr ""
 "tengan Extended Key Usage <quote>clientAuth</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr "maprule (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr "Define como se encuentra un usuario desde un certificado dado."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
@@ -6356,7 +6348,7 @@ msgstr ""
 "como <quote>ldap</quote>, <quote>AD</quote> o <quote>ipa</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
@@ -6365,12 +6357,12 @@ msgstr ""
 "encontrar un usuario con el mismo nombre."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr "domains (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -6383,17 +6375,17 @@ msgstr ""
 "usada para añadir la regla a los subdominios también."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr "Predetermiado: el dominio configurado en sssd.conf"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr "priority (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -6404,12 +6396,12 @@ msgstr ""
 "más alte mientras que <quote>4294967295</quote> es la más baja."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr "Predeterminado: la prioridad más baja"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
@@ -6419,7 +6411,7 @@ msgstr ""
 "propiedades especiales:"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
@@ -6428,7 +6420,7 @@ msgstr ""
 "usuario coincidente"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -6441,17 +6433,17 @@ msgstr ""
 "short_name})</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr "la opción <quote>domains</quote> es ignorada"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr "SECCIÓN DE CONFIGURACIÓN INICIAL"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -6466,7 +6458,7 @@ msgstr ""
 "al usuario las credenciales apropiadas."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -6479,22 +6471,22 @@ msgstr ""
 "Las siguientes opciones deberían suministrar una mejor flexibilidad aquí."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr "password_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr "cambiar la cadena de solicitud de contraseña"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6503,37 +6495,37 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr "[prompting/2fa]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr "para cambiar la cadena de la solicitud del primer factor"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr "second_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr "para cambiar la cadena de la solicitud para el segundo factor"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr "single_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 #, fuzzy
 #| msgid ""
 #| "boolean value, if True there will be only a single prompt using the value "
@@ -6550,7 +6542,7 @@ msgstr ""
 "única cadena"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -6558,20 +6550,31 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 #, fuzzy
 #| msgid "[prompting/password]"
 msgid "[prompting/passkey]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -6579,47 +6582,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 #, fuzzy
 #| msgid "first_prompt"
 msgid "interactive_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 #, fuzzy
 #| msgid "to change the string of the password prompt"
 msgid "to change the message of the interactive prompt."
 msgstr "cambiar la cadena de solicitud de contraseña"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 #, fuzzy
 #| msgid "first_prompt"
 msgid "touch_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 #, fuzzy
 #| msgid "to change the string of the password prompt"
 msgid "to change the message of the touch prompt."
 msgstr "cambiar la cadena de solicitud de contraseña"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 #, fuzzy
 #| msgid ""
 #| "to configure two-factor authentication prompting, allowed options are: "
@@ -6632,7 +6635,7 @@ msgstr ""
 "permitidas son: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 #, fuzzy
 #| msgid ""
 #| "Each supported authentication method has its own configuration subsection "
@@ -6651,7 +6654,7 @@ msgstr ""
 "type=\"variablelist\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -6662,12 +6665,12 @@ msgstr ""
 "pregunta para este servicio."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr "EJEMPLOS"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[sssd]\n"
@@ -6745,7 +6748,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6758,7 +6761,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6768,7 +6771,7 @@ msgstr ""
 "use_fully_qualified_names = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6785,7 +6788,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[certmap/my.domain/rule_name]\n"
@@ -6813,7 +6816,7 @@ msgstr ""
 "matchrule = &lt;ISSUER&gt;^CN=My-CA,DC=MY,DC=DOMAIN$&lt;SUBJECT&gt;^CN=User.Name,DC=MY,DC=DOMAIN$\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 #, fuzzy
 #| msgid ""
 #| "3. The following example shows the configuration for two certificate "
@@ -7034,7 +7037,7 @@ msgstr ""
 "http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Ejemplos:"
@@ -7537,7 +7540,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "Predeterminado: 900 (15 minutos)"
 
@@ -7858,7 +7861,7 @@ msgstr ""
 "de Certificación que <command>sssd</command> reconocerá."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -7873,11 +7876,19 @@ msgstr "ldap_tls_cacertdir (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "Especifica la ruta de un directorio que contiene los certificados de las "
 "Autoridades de Certificación en ficheros individuales separados. Normalmente "
@@ -7886,33 +7897,33 @@ msgstr ""
 "para crear los nombres correctos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 "Especifica el fichero que contiene el certificado para la clave del cliente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "Especifica el archivo que contiene la clave del cliente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -7923,12 +7934,12 @@ msgstr ""
 "conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 #, fuzzy
 #| msgid ""
 #| "Specifies that the id_provider connection must also use <systemitem "
@@ -7942,12 +7953,12 @@ msgstr ""
 "<systemitem class=\"protocol\">tls</systemitem> para proteger el canal."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -7958,18 +7969,18 @@ msgstr ""
 "ldap_user_uid_number y ldap_group_gid_number."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "Actualmente está función soporta sólo mapeos de objectSID de ActiveDirectory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr "ldap_min_id, ldap_max_id (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -7987,17 +7998,17 @@ msgstr ""
 "el servidor. Los subdominios pueden elegir otros rangos para asignar IDs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr "Predeterminado: no establecido (ambas opciones se establecen a 0)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
@@ -8006,7 +8017,7 @@ msgstr ""
 "soportados GSSAPI y GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -8023,12 +8034,12 @@ msgstr ""
 "manvolnum></citerefentry> para más detalles."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -8048,7 +8059,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -8068,17 +8079,17 @@ msgstr ""
 "principal en la pestaña."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "Por defecto: host/nombre_de_host@REALM"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -8089,17 +8100,17 @@ msgstr ""
 "reino también, esta opción se ignora."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "Por defecto: el valor de krb5_realm."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -8108,34 +8119,34 @@ msgstr ""
 "para para canocalizar el nombre de host durante una unión SASL."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Predeterminado: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr "Especifica la pestaña a usar cuando se utiliza SASL/GSSAPI/GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Por defecto: Keytab del sistema, normalmente <filename>/etc/krb5.keytab</"
 "filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -8146,12 +8157,12 @@ msgstr ""
 "es GSSAPI o GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
@@ -8159,17 +8170,17 @@ msgstr ""
 "SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Predeterminado: 86400 (24 horas)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -8188,7 +8199,7 @@ msgstr ""
 "información, vea la sección <quote>SERVICE DISCOVERY</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -8199,7 +8210,7 @@ msgstr ""
 "regresa a _tcp si no se encuentra nada."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -8211,30 +8222,30 @@ msgstr ""
 "configuración para usar <quote>krb5_server</quote> en su lugar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 "Especifica el REALM Kerberos (para autorización SASL/GSSAPI/GSS-SPNEGO)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 "Predeterminado: Predeterminados del sistema, vea <filename>/etc/krb5.conf</"
 "filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -8243,12 +8254,12 @@ msgstr ""
 "servidor LDAP. Esta función está disponible con MIT Kerberos >= 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -8263,7 +8274,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -8275,12 +8286,12 @@ msgstr ""
 "localizador."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -8289,7 +8300,7 @@ msgstr ""
 "del cliente. Los siguientes valores son permitidos:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -8298,7 +8309,7 @@ msgstr ""
 "no puede deshabilitar las políticas de password en el lado servidor."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 #, fuzzy
 #| msgid ""
 #| "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
@@ -8315,7 +8326,7 @@ msgstr ""
 "manvolnum></citerefentry> para evaluar si la contraseña ha expirado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -8327,7 +8338,7 @@ msgstr ""
 "password."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
@@ -8337,19 +8348,19 @@ msgstr ""
 "establecida por esta opción."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 "Especifica si el seguimiento de referencias automático debería ser "
 "habilitado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -8358,7 +8369,7 @@ msgstr ""
 "está compilado con OpenLDAP versión 2.4.13 o más alta."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 #, fuzzy
 #| msgid ""
 #| "Chasing referrals may incur a performance penalty in environments that "
@@ -8381,29 +8392,29 @@ msgstr ""
 "esta opción a false le llevará a una notable mejora de rendimiento."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "Especifica el nombre del servicio para utilizar cuando está habilitado el "
 "servicio de descubrimiento."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Predeterminado: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -8413,17 +8424,17 @@ msgstr ""
 "descubrimiento."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr "Por defecto: no fijado, esto es servicio descubridor deshabilitado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
@@ -8432,7 +8443,7 @@ msgstr ""
 "desde el Epoch después de una operación de cambio de contraseña."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -8441,12 +8452,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -8474,12 +8485,12 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Ejemplo:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -8491,7 +8502,7 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
@@ -8500,7 +8511,7 @@ msgstr ""
 "usuarios cuyo atributo employeeType esté establecido a \"admin\"."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -8513,17 +8524,17 @@ msgstr ""
 "se les seguirán otorgando acceso sin conexión y viceversa."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "Predeterminado: vacío"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -8532,7 +8543,7 @@ msgstr ""
 "control de acceso del lado cliente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -8543,12 +8554,12 @@ msgstr ""
 "una código de error definible aunque el password sea correcto."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Los siguientes valores están permitidos:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -8557,7 +8568,7 @@ msgstr ""
 "determinar si la cuenta ha expirado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -8570,7 +8581,7 @@ msgstr ""
 "se comprueba el tiempo de expiración de la cuenta."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -8581,7 +8592,7 @@ msgstr ""
 "el acceso o no."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -8594,7 +8605,7 @@ msgstr ""
 "permitido. Si ambos atributos están desaparecidos se concede el acceso."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -8605,24 +8616,24 @@ msgstr ""
 "la opción ldap_account_expire_policy funcione."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "Lista separada por coma de opciones de control de acceso.  Los valores "
 "permitidos son:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filtro</emphasis>: utilizar ldap_access_filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8638,7 +8649,7 @@ msgstr ""
 "funciones."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
@@ -8648,7 +8659,7 @@ msgstr ""
 "</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8670,12 +8681,12 @@ msgstr ""
 "estar establecido para que esta característica funcione."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>caducar</emphasis>: utilizar ldap_account_expire_policy"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -8690,41 +8701,47 @@ msgstr ""
 "método distinto a las contraseñas - por ejemplo claves SSH."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
+#, fuzzy
+#| msgid ""
+#| "Please note that 'access_provider = ldap' must be set for this feature to "
+#| "work. Also 'ldap_pwd_policy' must be set to an appropriate password "
+#| "policy."
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 "Por favor advierta que 'access_provider = ldap' debe estar establecido para "
 "que esta función trabaje. También 'ldap_pwd_policy' debe estar establecido "
 "para una política de contraseña apropiada."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -8733,13 +8750,13 @@ msgstr ""
 "autorizedService para determinar el acceso"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis>: usa el atributo host para determinar el acceso"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
@@ -8748,7 +8765,7 @@ msgstr ""
 "host remoto puede acceder"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
@@ -8758,12 +8775,12 @@ msgstr ""
 "opción de control de acceso"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Predeterminado: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -8772,12 +8789,12 @@ msgstr ""
 "una vez."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr "ldap_pwdlockout_dn (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -8791,22 +8808,22 @@ msgstr ""
 "LDAP no pueden verificarse correctamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr "Ejemplo: cn=ppolicy,ou=policies,dc=example,dc=com"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr "Predeterminado: cn=ppolicy,ou=policies,$ldap_search_base"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -8815,13 +8832,13 @@ msgstr ""
 "lleva a cabo una búsqueda. Están permitidas las siguientes opciones:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 "<emphasis>never</emphasis>: Nunca serán eliminadas las referencias al alias."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -8831,7 +8848,7 @@ msgstr ""
 "búsqueda."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -8840,7 +8857,7 @@ msgstr ""
 "cuando se localice el objeto base de la búsqueda."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -8849,7 +8866,7 @@ msgstr ""
 "para la búsqueda como en la localización del objeto base de la búsqueda."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -8858,12 +8875,12 @@ msgstr ""
 "librerías cliente LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -8872,7 +8889,7 @@ msgstr ""
 "servidores que usan el esquema RFC2307."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -8890,7 +8907,7 @@ msgstr ""
 "llamadas getpw*() o initgroups()."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -8901,12 +8918,12 @@ msgstr ""
 "initgroups() aumentará los usuarios locales con los grupos LDAP adicionales."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr "wildcard_limit (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
@@ -8915,59 +8932,77 @@ msgstr ""
 "descargadas durante una búsqueda de comodín."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 "En este momento solo el respondedor InfoPipe soporta búsqueda de comodín"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr "Predeterminado: 1000 (frecuentemente el tamaño de una página)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "debug_level (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "debug_level (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 #, fuzzy
 #| msgid "Default: 0 (disabled)"
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "Predeterminado: 0 (deshabilitado)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "ldap_id_mapping (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_id_mapping (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (entero)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -8989,12 +9024,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "OPCIONES SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -9005,12 +9040,12 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
@@ -9020,7 +9055,7 @@ msgstr ""
 "servidor)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -9029,24 +9064,24 @@ msgstr ""
 "emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "Por defecto: 21600 (6 horas)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -9058,7 +9093,7 @@ msgstr ""
 "actualmente SSSD)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
@@ -9067,7 +9102,7 @@ msgstr ""
 "atributo modifyTimestamp."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -9083,21 +9118,21 @@ msgstr ""
 "<emphasis>ldap_connection_expire_timeout</emphasis>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_idmap_range_size (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -9105,7 +9140,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -9113,17 +9148,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
@@ -9132,12 +9167,12 @@ msgstr ""
 "máquina (usando las direcciones de host/red y nombres de host IPv4 o IPv6)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -9146,7 +9181,7 @@ msgstr ""
 "totalmente cualificados que sería usada para filtrar las reglas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
@@ -9155,8 +9190,8 @@ msgstr ""
 "nombre de dominio totalmente cualificado automáticamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -9165,17 +9200,17 @@ msgstr ""
 "emphasis> esta opción no tiene efecto."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "Por defecto: no especificado"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -9184,7 +9219,7 @@ msgstr ""
 "usada para filtrar las reglas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -9193,12 +9228,12 @@ msgstr ""
 "automáticamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "sudo_include_netgroups (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
@@ -9207,12 +9242,12 @@ msgstr ""
 "atributo sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
@@ -9221,7 +9256,7 @@ msgstr ""
 "atributo sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
@@ -9230,7 +9265,7 @@ msgstr ""
 "del servidor LDAP!"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -9243,12 +9278,12 @@ msgstr ""
 "manvolnum> </citerefentry>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "OPCIONES AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
@@ -9257,47 +9292,47 @@ msgstr ""
 "esquema LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "El nombre del mapa maestro de montaje automático en LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "Pfredeterminado: auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "OPCIONES AVANZADAS"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr "<note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -9310,22 +9345,22 @@ msgstr ""
 "función, si los nombres de grupo no están siendo visualizados correctamente."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr "</note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -9338,14 +9373,14 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "EJEMPLO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -9356,7 +9391,7 @@ msgstr ""
 "replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9376,20 +9411,20 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr "EJEMPLO DE FILTRO DE ACCESO LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
@@ -9398,7 +9433,7 @@ msgstr ""
 "ldap_access_order=lockout."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9424,13 +9459,13 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTAS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -12107,7 +12142,7 @@ msgstr ""
 "este host. El nombre de host debe ser totalmente cualificado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (booleano)"
 
@@ -12127,7 +12162,7 @@ msgstr ""
 "otra manera utilizando la opción <quote>dyndns_iface</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -12148,12 +12183,12 @@ msgstr ""
 "usar <emphasis>dyndns_update</emphasis> en su fichero de configuración."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -12180,12 +12215,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Por defecto: 1200 (segundos)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -12218,17 +12253,17 @@ msgstr ""
 "conexión IPA LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr "Ejemplo: dyndns_iface = em1, vnet1, vnet2"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr "dyndns_auth (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -12239,19 +12274,19 @@ msgstr ""
 "se pueden enviar fijando esta opción a 'none'."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr "Predeterminado: GSS-TSIG"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 #, fuzzy
 #| msgid "dyndns_auth (string)"
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_auth (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 #, fuzzy
 #| msgid ""
 #| "Whether the nsupdate utility should use GSS-TSIG authentication for "
@@ -12267,7 +12302,7 @@ msgstr ""
 "se pueden enviar fijando esta opción a 'none'."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -12304,7 +12339,7 @@ msgstr ""
 "tradicional SRV son usados como servidores de respaldo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (entero)"
 
@@ -12321,12 +12356,12 @@ msgstr ""
 "dyndns_update está a true."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -12346,7 +12381,7 @@ msgstr ""
 "se cambian los registros que envía."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -12358,12 +12393,12 @@ msgid "Default: False (disabled)"
 msgstr "Predeterminado: False (deshabilitado)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -12372,17 +12407,17 @@ msgstr ""
 "comunica con el servidor DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Predeterminado: False (permitir a nsupdate elegir el protocolol)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr "dyndns_server (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
@@ -12392,7 +12427,7 @@ msgstr ""
 "establecer."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
@@ -12401,7 +12436,7 @@ msgstr ""
 "servidor DNS es distinto del servidor de identidad."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
@@ -12410,17 +12445,17 @@ msgstr ""
 "cuando el intento anterior de usar la configuración autodetectada falló."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr "Predeterminado: None (permitir a nsupdate elegir el servidor)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr "dyndns_update_per_family (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -12608,12 +12643,12 @@ msgstr ""
 "convertido hacia la base DN para usarlo para llevar a cabo operaciones LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr "krb5_confd_path (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
@@ -12622,7 +12657,7 @@ msgstr ""
 "configuración de Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
@@ -12631,7 +12666,7 @@ msgstr ""
 "parámetro a 'none'."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -12655,7 +12690,7 @@ msgstr ""
 "hay muchas solicitudes de perfiles de escritorio en un período corto."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "Predeterminado: 5 (segundos)"
 
@@ -13539,19 +13574,16 @@ msgstr "ad_access_filter (cadena)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
-"Esta opción especifica el filtro de control de acceso LDAP con el que el "
-"usuario debe coincidir con el objetivo de tener permitido el acceso. Por "
-"favor advierta que la opción <quote>access_provider</quote> debe estar "
-"establecida explícitamente a <quote>ad</quote> con el objetivo de que esta "
-"opción tenga efecto."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -13564,7 +13596,7 @@ msgstr ""
 "<quote>FOREST</quote> o ninguna."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -13577,7 +13609,7 @@ msgstr ""
 "dominios del bosque especificado por <quote>NAME</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
@@ -13586,7 +13618,7 @@ msgstr ""
 "modo similar a como funcionan las bases de búsqueda."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -13607,7 +13639,7 @@ msgstr ""
 "extensiones LDAP</ulink>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -13620,7 +13652,7 @@ msgstr ""
 "con la misma especificación se usa la primera."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -13650,12 +13682,12 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr "ad_site (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
@@ -13664,12 +13696,12 @@ msgstr ""
 "suministra esta opción se autodescubrirá el sitio AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -13682,7 +13714,7 @@ msgstr ""
 "hace que SSSD solo conecte al puerto LDAP del servidor AD actual."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -13696,12 +13728,12 @@ msgstr ""
 "membresías de grupo de dominio cruzado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -13716,7 +13748,7 @@ msgstr ""
 "objetivo de que esta opción tenga efecto."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -13729,7 +13761,7 @@ msgstr ""
 "opciones <quote>ad_gpo_map</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -13738,7 +13770,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -13753,7 +13785,7 @@ msgstr ""
 "los que pertenece debe tener los siguientes permisos en el GPO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
@@ -13762,7 +13794,7 @@ msgstr ""
 "propiedad de la GPO (RIGHT_DS_READ_PROPERTY)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
@@ -13771,7 +13803,7 @@ msgstr ""
 "tener permiso para aplicar la GPO (RIGHT_DS_CONTROL_ACCESS)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -13787,7 +13819,7 @@ msgstr ""
 "GPO se aplicarán siempre también al usuario."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -13814,12 +13846,12 @@ msgstr ""
 "citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr "Hay tres valores soportados para esta opción:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
@@ -13827,14 +13859,14 @@ msgstr ""
 "son evaluadas ni aplicadas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 "enforcing (hacer cumplir): Las reglas de control de acceso basadas en GPO "
 "son evaluadas y aplicadas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -13846,22 +13878,22 @@ msgstr ""
 "si el valor de la opción estuviera establecido en enforcing."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "Predeterminado: permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr "Predeterminado: enforcing"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr "ad_gpo_implicit_deny (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -13879,7 +13911,7 @@ msgstr ""
 "administradores integrados si no se aplican reglas de GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -13887,84 +13919,84 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 #, fuzzy
 #| msgid "ad_gpo_implicit_deny (boolean)"
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr "ad_gpo_implicit_deny (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 #, fuzzy
 #| msgid "All users are recorded."
 msgid "all users are allowed"
 msgstr "Se graban todos los usuarios."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "only users in allow-rules are allowed"
 msgstr "Los siguientes valores están permitidos:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 #, fuzzy
 #| msgid "ad_gpo_implicit_deny (boolean)"
 msgid "ad_gpo_implicit_deny = True"
 msgstr "ad_gpo_implicit_deny (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 #, fuzzy
 #| msgid "No users are recorded."
 msgid "no users are allowed"
 msgstr "NO se grabaron usuarios."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr "ad_gpo_ignore_unreadable (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -13979,12 +14011,12 @@ msgstr ""
 "los contenedores de política de grupo no son legibles por SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -13992,12 +14024,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -14013,14 +14045,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -14028,7 +14060,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14040,42 +14072,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -14091,7 +14123,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -14099,7 +14131,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -14107,7 +14139,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14119,22 +14151,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -14150,7 +14182,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -14158,7 +14190,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -14166,7 +14198,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14178,22 +14210,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -14208,14 +14240,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -14223,7 +14255,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14235,23 +14267,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -14267,14 +14299,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -14282,7 +14314,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -14293,19 +14325,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -14313,7 +14345,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14325,29 +14357,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -14355,12 +14387,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -14373,52 +14405,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -14426,17 +14458,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -14446,17 +14478,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -14465,12 +14497,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -14481,14 +14513,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 #, fuzzy
 #| msgid "ldap_sudo_include_netgroups (boolean)"
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "sudo_include_netgroups (booleano)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -14499,7 +14531,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -14514,7 +14546,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -14526,7 +14558,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -14537,19 +14569,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -14559,7 +14591,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -14570,7 +14602,7 @@ msgstr ""
 "Este ejemplo muestra sólo las opciones específicas del proveedor AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -14594,7 +14626,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -14606,7 +14638,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -14617,7 +14649,7 @@ msgstr ""
 "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -14627,7 +14659,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -15214,76 +15246,89 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 #, fuzzy
 #| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
 msgstr "Opciones de configuración de NSS"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 #, fuzzy
 #| msgid ""
 #| "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
@@ -17258,7 +17303,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -17295,8 +17340,59 @@ msgstr ""
 "Busca las claves públicas del host en el dominio SSSD <replaceable>DOMAIN</"
 "replaceable>."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-R</option>,<option>--no-remove</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-R</option>,<option>--no-remove</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -21311,14 +21407,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -21901,6 +21996,28 @@ msgid ""
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (entero)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Cantidad de intentos de reconexión de los servicios ante una eventual "
+#~ "caída de datos del  proveedor, o de reiniciarse antes de abandonar"
+
+#~ msgid ""
+#~ "This option specifies LDAP access control filter that the user must match "
+#~ "in order to be allowed access. Please note that the "
+#~ "<quote>access_provider</quote> option must be explicitly set to "
+#~ "<quote>ad</quote> in order for this option to have an effect."
+#~ msgstr ""
+#~ "Esta opción especifica el filtro de control de acceso LDAP con el que el "
+#~ "usuario debe coincidir con el objetivo de tener permitido el acceso. Por "
+#~ "favor advierta que la opción <quote>access_provider</quote> debe estar "
+#~ "establecida explícitamente a <quote>ad</quote> con el objetivo de que "
+#~ "esta opción tenga efecto."
+
 #, fuzzy
 #~| msgid ""
 #~| "The user to drop the privileges to where appropriate to avoid running as "
@@ -22404,9 +22521,6 @@ msgstr ""
 #~ "directorio home mismo y el buzón de correo del usuario. Reescribe la "
 #~ "configuración."
 
-#~ msgid "<option>-R</option>,<option>--no-remove</option>"
-#~ msgstr "<option>-R</option>,<option>--no-remove</option>"
-
 #~ msgid ""
 #~ "Files in the user's home directory will NOT be removed along with the "
 #~ "home directory itself and the user's mail spool. Overrides the "
diff --git a/src/man/po/eu.po b/src/man/po/eu.po
index af0606c426e..3fffc28975f 100644
--- a/src/man/po/eu.po
+++ b/src/man/po/eu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2014-12-14 11:55-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Basque (http://www.transifex.com/projects/p/sssd/language/"
@@ -209,13 +209,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr ""
 
@@ -232,11 +232,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -269,8 +269,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -300,8 +300,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -337,46 +337,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr ""
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -387,19 +368,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -407,12 +388,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -420,70 +401,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -491,7 +472,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -499,52 +480,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -552,14 +533,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -569,17 +550,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -589,7 +570,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -602,8 +583,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -611,12 +592,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -626,7 +607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -635,22 +616,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -658,12 +639,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -671,61 +652,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -733,12 +714,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -746,24 +727,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -772,12 +753,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -786,7 +767,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -794,58 +775,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -856,7 +837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -874,18 +855,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -893,12 +874,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -906,24 +887,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -931,7 +912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -950,12 +931,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -964,22 +945,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -989,17 +970,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1009,17 +990,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1030,14 +1011,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1045,44 +1026,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1091,58 +1072,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1154,58 +1135,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1213,7 +1194,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1223,7 +1204,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1232,17 +1213,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1250,17 +1231,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1268,17 +1249,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1287,7 +1268,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1296,41 +1277,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1338,23 +1319,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1362,47 +1343,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1410,113 +1391,113 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1524,25 +1505,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1550,19 +1531,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1570,12 +1551,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1584,12 +1565,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1600,43 +1581,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1645,60 +1626,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1706,59 +1687,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1767,51 +1748,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1822,23 +1803,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1846,7 +1827,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1855,17 +1836,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1873,31 +1854,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1907,75 +1889,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1983,19 +1965,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2003,46 +1985,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2050,34 +2032,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2087,7 +2069,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2095,59 +2077,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2155,7 +2137,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2167,63 +2149,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2231,12 +2213,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2247,7 +2229,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2255,7 +2237,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2263,7 +2245,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2272,47 +2254,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2321,30 +2303,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2352,7 +2334,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2360,22 +2342,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2383,19 +2365,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2403,7 +2385,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2418,7 +2400,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2426,45 +2408,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2472,7 +2454,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2480,17 +2462,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2501,24 +2483,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2528,22 +2510,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2551,51 +2533,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2604,12 +2586,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2619,7 +2601,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2627,7 +2609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2636,38 +2618,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2678,7 +2660,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2689,24 +2671,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2714,19 +2696,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2735,7 +2717,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2744,24 +2726,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2772,24 +2754,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2797,24 +2779,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2826,7 +2808,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2837,60 +2819,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2900,66 +2882,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2967,17 +2949,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -2985,7 +2967,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -2994,57 +2976,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3054,12 +3036,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3068,14 +3050,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3084,38 +3066,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3124,24 +3106,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3150,36 +3132,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3193,14 +3175,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3209,14 +3191,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3224,32 +3206,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3258,19 +3240,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3281,139 +3263,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3422,17 +3404,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3444,18 +3426,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3466,7 +3448,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3475,12 +3457,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3488,19 +3470,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3509,17 +3491,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3528,28 +3510,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3557,7 +3539,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3565,8 +3547,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3574,8 +3556,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3583,19 +3565,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3604,7 +3586,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3612,24 +3594,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3641,7 +3623,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3649,30 +3631,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3680,7 +3662,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3688,30 +3670,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3719,19 +3701,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3740,7 +3722,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3748,29 +3730,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3778,7 +3760,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3786,35 +3768,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3822,32 +3804,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3858,7 +3840,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3867,12 +3849,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3880,7 +3862,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3888,31 +3870,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3920,7 +3902,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3929,17 +3911,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3947,36 +3929,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3984,7 +3966,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3992,7 +3974,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4000,24 +3982,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4025,31 +4007,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4057,7 +4039,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4066,12 +4048,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4081,24 +4063,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4107,19 +4089,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4129,102 +4111,107 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4233,12 +4220,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4246,7 +4233,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4254,34 +4241,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4289,57 +4276,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 msgid "Default: 31"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4347,31 +4334,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4379,104 +4366,104 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4484,27 +4471,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4514,34 +4501,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4550,19 +4537,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4570,12 +4557,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4587,7 +4574,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4599,7 +4586,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4607,42 +4594,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4651,7 +4638,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4662,7 +4649,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4670,36 +4657,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 msgid "Default: match"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4708,24 +4695,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4735,14 +4722,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4750,21 +4737,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4772,7 +4759,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4781,7 +4768,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4790,7 +4777,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4798,17 +4785,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4816,12 +4803,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4829,12 +4816,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4842,12 +4829,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4856,12 +4843,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4869,19 +4856,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4898,7 +4885,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4906,17 +4893,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4925,7 +4912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4935,7 +4922,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -4955,12 +4942,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -4971,69 +4958,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5046,7 +5033,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5054,7 +5041,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5063,55 +5050,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5120,17 +5107,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5138,26 +5125,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5166,17 +5153,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5186,7 +5173,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5195,59 +5182,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5256,7 +5243,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5264,18 +5251,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5283,46 +5281,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5331,7 +5329,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5339,12 +5337,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5373,7 +5371,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5382,7 +5380,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5390,7 +5388,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5401,7 +5399,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5412,7 +5410,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5574,7 +5572,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -5986,7 +5984,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6239,7 +6237,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6256,36 +6254,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6293,12 +6292,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6306,12 +6305,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6319,17 +6318,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6340,24 +6339,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6368,12 +6367,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6386,7 +6385,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6398,17 +6397,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6416,49 +6415,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6466,28 +6465,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6499,7 +6498,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6507,7 +6506,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6515,39 +6514,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6557,7 +6556,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6565,26 +6564,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6593,7 +6592,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6601,31 +6600,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6638,51 +6637,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6691,12 +6690,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6712,12 +6711,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6726,14 +6725,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6742,24 +6741,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6767,19 +6766,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6788,7 +6787,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6796,7 +6795,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6805,7 +6804,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6813,22 +6812,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6838,14 +6837,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6858,12 +6857,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6873,81 +6872,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -6956,74 +6956,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7034,7 +7034,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7042,64 +7042,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7113,12 +7129,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7126,43 +7142,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7170,14 +7186,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7187,19 +7203,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7207,7 +7223,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7215,106 +7231,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7323,59 +7339,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7384,22 +7400,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7408,14 +7424,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7423,7 +7439,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7436,27 +7452,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7472,13 +7488,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9717,7 +9733,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9732,7 +9748,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9747,12 +9763,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9773,12 +9789,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9802,17 +9818,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9820,17 +9836,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9838,7 +9854,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9865,7 +9881,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9878,12 +9894,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9897,7 +9913,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9909,60 +9925,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10110,26 +10126,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10148,7 +10164,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10863,14 +10879,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10879,7 +10897,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10888,14 +10906,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10908,7 +10926,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10917,7 +10935,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10935,24 +10953,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -10961,7 +10979,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -10970,12 +10988,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -10985,7 +11003,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -10994,7 +11012,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11003,7 +11021,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11013,21 +11031,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11037,7 +11055,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11052,23 +11070,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11076,22 +11094,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11102,7 +11120,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11110,74 +11128,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11187,12 +11205,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11200,12 +11218,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11221,14 +11239,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11236,7 +11254,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11248,42 +11266,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11299,7 +11317,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11307,7 +11325,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11315,7 +11333,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11327,22 +11345,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11358,7 +11376,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11366,7 +11384,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11374,7 +11392,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11386,22 +11404,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11416,14 +11434,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11431,7 +11449,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11443,23 +11461,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11475,14 +11493,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11490,7 +11508,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11501,19 +11519,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11521,7 +11539,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11533,29 +11551,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11563,12 +11581,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11581,52 +11599,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11634,17 +11652,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11654,17 +11672,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11673,12 +11691,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11689,12 +11707,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11705,7 +11723,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11720,7 +11738,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11732,7 +11750,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11743,19 +11761,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11765,7 +11783,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11773,7 +11791,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11788,7 +11806,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11797,7 +11815,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11805,7 +11823,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11815,7 +11833,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12298,74 +12316,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14160,7 +14191,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14181,8 +14212,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17849,14 +17929,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/fi.po b/src/man/po/fi.po
index 924fdfc4d93..9201be2ddf5 100644
--- a/src/man/po/fi.po
+++ b/src/man/po/fi.po
@@ -3,7 +3,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2022-03-20 19:16+0000\n"
 "Last-Translator: Jan Kuparinen <copper_fin@hotmail.com>\n"
 "Language-Team: Finnish <https://translate.fedoraproject.org/projects/sssd/"
@@ -205,13 +205,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Oletus:tosi"
 
@@ -228,11 +228,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Oletus:epätosi"
@@ -265,8 +265,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -296,8 +296,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -333,46 +333,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr ""
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "toimialueet"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -383,19 +364,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -403,12 +384,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -416,58 +397,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "käyttäjänimi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -476,12 +457,12 @@ msgstr ""
 "tunnistaakseen, milloin sen on päivitettävä sisäinen DNS-selvittäjä."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -489,7 +470,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -497,26 +478,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -525,26 +506,26 @@ msgstr ""
 "toiston välimuistitiedostot."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -552,14 +533,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -569,17 +550,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -589,7 +570,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -602,8 +583,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -611,12 +592,12 @@ msgid "Default: not set"
 msgstr "Oletus: ei asetettu"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -626,7 +607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -635,22 +616,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Oletus: ei asetettu(välilyöntejä ei korvata)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -658,12 +639,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -671,61 +652,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -733,12 +714,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -746,24 +727,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -772,12 +753,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -786,7 +767,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -794,58 +775,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -856,7 +837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -874,18 +855,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Oletus: ei asetettu"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -893,12 +874,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -906,24 +887,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -931,7 +912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -950,12 +931,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -964,22 +945,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -989,17 +970,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1009,17 +990,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1030,14 +1011,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1045,44 +1026,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout_max (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1091,58 +1072,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr "Oletus: 3600"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout_random_offset (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr "Oletus: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1154,58 +1135,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1213,7 +1194,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1223,7 +1204,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1232,17 +1213,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1250,17 +1231,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1268,17 +1249,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1287,7 +1268,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1296,41 +1277,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1338,23 +1319,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Esimerkki: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1362,47 +1343,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1410,113 +1391,113 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "Oletuskomentorivitulkki"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr "memcache_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr "memcache_size_passwd (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1524,25 +1505,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr "memcache_size_group (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1550,19 +1531,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr "memcache_size_initgroups (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1570,14 +1551,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "memcache_size_passwd (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "memcache_size_passwd (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1586,12 +1567,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1602,43 +1583,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr "Oletus: <quote>*</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1647,60 +1628,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1708,59 +1689,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1769,51 +1750,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1824,23 +1805,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1848,7 +1829,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1857,17 +1838,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1875,31 +1856,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1909,75 +1891,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Oletus: ei mitään"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1985,19 +1967,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2005,46 +1987,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Oletus:tosi"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Oletus:epätosi"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2052,34 +2034,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr "Oletus:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2089,7 +2071,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2099,61 +2081,61 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "entry_cache_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "entry_cache_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2161,7 +2143,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2173,63 +2155,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "kirjautuminen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2237,12 +2219,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2253,7 +2235,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2261,7 +2243,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2269,7 +2251,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2278,47 +2260,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr "aina"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr "Ei koskaan"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2327,30 +2309,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2358,7 +2340,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2368,22 +2350,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Esimerkki: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2391,19 +2373,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2411,7 +2393,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2426,7 +2408,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2434,45 +2416,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2480,7 +2462,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2488,17 +2470,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr "Oletus: ei asetettu(todennusindikaattoreiden käyttöä ei vaadita)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2509,24 +2491,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2536,22 +2518,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2559,51 +2541,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2612,12 +2594,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2627,7 +2609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2635,7 +2617,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2644,38 +2626,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2686,7 +2668,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2697,24 +2679,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2722,19 +2704,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2743,7 +2725,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2752,24 +2734,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2780,26 +2762,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 #, fuzzy
 #| msgid "present"
 msgid "pac_present"
 msgstr "nykyinen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2807,24 +2789,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2836,7 +2818,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2847,60 +2829,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2910,66 +2892,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2977,17 +2959,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -2995,7 +2977,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3004,57 +2986,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr "käytössä"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3064,12 +3046,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3078,14 +3060,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3094,38 +3076,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3134,24 +3116,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3160,36 +3142,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3203,14 +3185,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3219,14 +3201,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3234,32 +3216,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "kaikki"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "Ei mitään"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3268,19 +3250,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3291,139 +3273,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3432,17 +3414,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3454,18 +3436,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3476,7 +3458,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3485,12 +3467,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3498,19 +3480,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3519,17 +3501,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3538,28 +3520,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3567,7 +3549,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3575,8 +3557,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3584,8 +3566,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3593,19 +3575,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3614,7 +3596,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3622,24 +3604,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3651,7 +3633,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3659,30 +3641,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3690,7 +3672,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3698,30 +3680,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3729,19 +3711,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3750,7 +3732,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3758,29 +3740,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3788,7 +3770,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3796,35 +3778,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3832,32 +3814,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3868,7 +3850,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3877,12 +3859,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3890,7 +3872,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3898,31 +3880,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3930,7 +3912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3939,17 +3921,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3957,36 +3939,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3994,7 +3976,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4002,7 +3984,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4010,24 +3992,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4035,31 +4017,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4067,7 +4049,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4076,12 +4058,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4091,24 +4073,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "käyttäjänimi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4117,19 +4099,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4139,102 +4121,107 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_server_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4243,14 +4230,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_server_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_server_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4258,7 +4245,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4266,38 +4253,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 #, fuzzy
 #| msgid "Default: True"
 msgid "Default: TRUE"
 msgstr "Oletus:tosi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "dns_resolver_op_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "dns_resolver_op_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4305,59 +4292,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 30"
 msgid "Default: 31"
 msgstr "Oletus: 30"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "epätosi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4365,31 +4352,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4397,124 +4384,124 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout"
 msgid "ldap_search_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_network_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout"
 msgid "ldap_opt_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_offline_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout"
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_enumeration_search_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_connection_expire_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_connection_expire_offset"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "client_idle_timeout"
 msgid "ldap_connection_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4524,27 +4511,27 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4554,34 +4541,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4590,19 +4577,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4610,14 +4597,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_user_principal"
 msgid "local_auth_policy (string)"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4629,7 +4616,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4641,7 +4628,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4649,46 +4636,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_user_principal"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 #, fuzzy
 #| msgid "enabled"
 msgid "disabled"
 msgstr "käytössä"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4697,7 +4684,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4708,7 +4695,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4716,38 +4703,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: true"
 msgid "Default: match"
 msgstr "Oletus:tosi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr "tosi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4756,24 +4743,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr "epätosi"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4783,14 +4770,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4798,21 +4785,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4820,7 +4807,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4829,7 +4816,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4838,7 +4825,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4846,17 +4833,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4864,12 +4851,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4877,12 +4864,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4890,12 +4877,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4904,12 +4891,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4917,19 +4904,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4946,7 +4933,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4954,17 +4941,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4973,7 +4960,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4983,7 +4970,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5003,12 +4990,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5019,69 +5006,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5094,7 +5081,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5102,7 +5089,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5111,55 +5098,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5168,17 +5155,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5186,26 +5173,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5214,17 +5201,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5234,7 +5221,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5243,59 +5230,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5304,7 +5291,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5312,18 +5299,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5331,46 +5329,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5379,7 +5377,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5387,12 +5385,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5421,7 +5419,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5430,7 +5428,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5438,7 +5436,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5449,7 +5447,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5460,7 +5458,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5622,7 +5620,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Esimerkki:"
@@ -6034,7 +6032,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6289,7 +6287,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6306,36 +6304,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6343,12 +6342,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6356,12 +6355,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6369,17 +6368,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6390,24 +6389,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6418,12 +6417,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6436,7 +6435,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6448,17 +6447,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6466,49 +6465,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Oletus: epätosi;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6516,28 +6515,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6549,7 +6548,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6557,7 +6556,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6565,39 +6564,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6607,7 +6606,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6615,26 +6614,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6643,7 +6642,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6651,31 +6650,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6688,51 +6687,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6741,12 +6740,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6762,12 +6761,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Esimerkki:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6776,14 +6775,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6792,24 +6791,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6817,19 +6816,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6838,7 +6837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6846,7 +6845,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6855,7 +6854,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6863,22 +6862,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6888,14 +6887,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6908,12 +6907,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6923,81 +6922,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7006,74 +7006,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7084,7 +7084,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7092,64 +7092,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr "ldap_library_debug_level (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_library_debug_level (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_library_debug_level (integeri)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7163,12 +7181,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7176,43 +7194,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7220,14 +7238,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7237,19 +7255,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7257,7 +7275,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7265,106 +7283,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7373,59 +7391,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7434,22 +7452,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7458,14 +7476,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7473,7 +7491,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7486,27 +7504,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7522,13 +7540,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9767,7 +9785,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9782,7 +9800,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9797,12 +9815,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9823,12 +9841,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9852,17 +9870,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9870,17 +9888,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9888,7 +9906,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9915,7 +9933,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9928,12 +9946,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9947,7 +9965,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9959,60 +9977,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10160,26 +10178,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10198,7 +10216,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10913,14 +10931,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10929,7 +10949,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10938,14 +10958,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10958,7 +10978,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10967,7 +10987,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10985,24 +11005,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11011,7 +11031,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11020,12 +11040,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11035,7 +11055,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11044,7 +11064,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11053,7 +11073,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11063,21 +11083,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11087,7 +11107,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11102,23 +11122,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11126,22 +11146,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11152,7 +11172,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11160,74 +11180,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr "puuttuu"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr "nykyinen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11237,12 +11257,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr "ad_gpo_cache_timeout (integeri)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11250,12 +11270,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11271,14 +11291,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11286,7 +11306,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11298,42 +11318,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr "yhtenäisyys"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11349,7 +11369,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11357,7 +11377,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11365,7 +11385,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11377,22 +11397,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr "cockpit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11408,7 +11428,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11416,7 +11436,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11424,7 +11444,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11436,22 +11456,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11466,14 +11486,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11481,7 +11501,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11493,23 +11513,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11525,14 +11545,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11540,7 +11560,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11551,19 +11571,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11571,7 +11591,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11583,29 +11603,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11613,12 +11633,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11631,52 +11651,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr "verkko"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr "palvelu"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11684,17 +11704,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11704,17 +11724,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11723,12 +11743,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11739,12 +11759,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11755,7 +11775,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11770,7 +11790,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11782,7 +11802,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11793,19 +11813,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11815,7 +11835,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11823,7 +11843,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11838,7 +11858,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11847,7 +11867,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11855,7 +11875,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11865,7 +11885,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12348,74 +12368,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14210,7 +14243,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14231,8 +14264,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17903,14 +17985,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/fr.po b/src/man/po/fr.po
index b876b781060..bc8116a97f4 100644
--- a/src/man/po/fr.po
+++ b/src/man/po/fr.po
@@ -17,7 +17,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2020-07-22 07:49-0400\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: French (http://www.transifex.com/projects/p/sssd/language/"
@@ -250,13 +250,13 @@ msgstr ""
 "la journalisation de débogage de SSSD, cette option sera ignorée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Par défaut : true"
 
@@ -276,11 +276,11 @@ msgstr ""
 "sera ignorée."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Par défaut : false"
@@ -315,8 +315,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -346,8 +346,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Par défaut : 10"
 
@@ -382,12 +382,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
-msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
+msgid ""
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Les services pris en charge : nss, pam <phrase condition=\"with_sudo\">, "
 "sudo</phrase> <phrase condition=\"with_autofs\"> ,autofs</phrase> <phrase "
@@ -396,41 +402,20 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (entier)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Nombre d'essais de reconnection ou de redémarrage que les services doivent "
-"effectuer dans le cas d'un plantage du fournisseur de données avant "
-"d'abandonner"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Par défaut : 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domaines"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -441,12 +426,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -455,7 +440,7 @@ msgstr ""
 "contenant le nom d'utilisateur et de domaine dans ces composants."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -463,12 +448,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -480,33 +465,33 @@ msgstr ""
 "domaine."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "nom d'utilisateur"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 "nom de domaine tel qu'indiqué dans le fichier de configuration de SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -516,7 +501,7 @@ msgstr ""
 "d'approbation IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -525,31 +510,31 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -557,7 +542,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -567,7 +552,7 @@ msgstr ""
 "conseillée. Dans ces rares cas, cette option devrait être définie à « false »"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -576,7 +561,7 @@ msgstr ""
 "sur les autres plates-formes."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -586,12 +571,12 @@ msgstr ""
 "utilisée."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -600,7 +585,7 @@ msgstr ""
 "de rejeu Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -610,7 +595,7 @@ msgstr ""
 "relecture."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -619,12 +604,12 @@ msgstr ""
 "la construction du logiciel. (__LIBKRB5_DEFAULTS__ si non configuré)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr "user (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -632,14 +617,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -649,17 +634,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr "Par défaut : non défini, le processus tourne en tant que root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -675,7 +660,7 @@ msgstr ""
 "domaine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -688,8 +673,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -697,12 +682,12 @@ msgid "Default: not set"
 msgstr "Par défaut : non défini"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr "override_space (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -718,7 +703,7 @@ msgstr ""
 "défaut de l'interpréteur de commande."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -727,22 +712,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Par défaut : non défini (les espaces ne seront pas remplacées)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -750,12 +735,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -763,61 +748,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -825,12 +810,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -838,24 +823,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 #, fuzzy
 #| msgid ""
 #| "Please refer to the <quote>dns_discovery_domain</quote> parameter in the "
@@ -872,12 +857,12 @@ msgstr ""
 "manvolnum></citerefentry> pour plus de détails."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -886,7 +871,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -894,58 +879,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -956,7 +941,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -974,20 +959,20 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Par défaut : non défini"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 #, fuzzy
 #| msgid "ipa_server_mode (boolean)"
 msgid "implicit_pac_responder (boolean)"
 msgstr "ipa_server_mode (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -995,14 +980,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 #, fuzzy
 #| msgid "ad_enable_gc (boolean)"
 msgid "core_dumpable (boolean)"
 msgstr "ad_enable_gc (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1010,28 +995,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "ldap_user_certificate (string)"
 msgid "passkey_verification (string)"
 msgstr "ldap_user_certificate (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "ldap_user_certificate (string)"
 msgid "user_verification (boolean)"
 msgstr "ldap_user_certificate (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1039,7 +1024,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -1070,12 +1055,12 @@ msgstr ""
 "l'identité des domaines. <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "SECTIONS DE SERVICES"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1088,22 +1073,22 @@ msgstr ""
 "section doit être <quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Options générales de configuration de service"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Ces options peuvent être utilisées pour configurer les services."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1118,17 +1103,17 @@ msgstr ""
 "valeur inférieure  ou la limite « hard » de limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "Par défault : 8192 (ou la limite « hard » de limits.conf)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1138,19 +1123,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 60, KCM: 300"
 msgstr "Par défaut : 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1161,14 +1146,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1176,46 +1161,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Par défaut : 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "offline_timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1224,66 +1209,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "Par défaut : 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "offline_timeout + random_offset"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout + random_offset"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 #, fuzzy
 #| msgid "offline_timeout + random_offset"
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "offline_timeout + random_offset"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "Par défaut : 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1295,30 +1280,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Par défaut : 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "Options de configuration NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1326,12 +1311,12 @@ msgstr ""
 "Switch (NSS)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1340,17 +1325,17 @@ msgstr ""
 "énumérations (requêtes sur les informations de tous les utilisateurs)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Par défaut : 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1361,7 +1346,7 @@ msgstr ""
 "valeur de entry_cache_timeout pour le domaine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1377,7 +1362,7 @@ msgstr ""
 "cache."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1390,17 +1375,17 @@ msgstr ""
 "de non réponse à moins de 10 secondes (0 pour désactiver l'option)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Par défaut : 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1412,17 +1397,17 @@ msgstr ""
 "appel au moteur."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Par défaut : 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1430,17 +1415,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1449,7 +1434,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1458,17 +1443,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Par défaut : root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1476,12 +1461,12 @@ msgstr ""
 "membres de groupes."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1490,7 +1475,7 @@ msgstr ""
 "explicitement spécifié par le fournisseur de données du domaine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1498,7 +1483,7 @@ msgstr ""
 "override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1508,25 +1493,25 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "exemple : <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 "Par défaut : non défini (aucune substitution pour les répertoires d'accueil "
 "non définis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1538,17 +1523,17 @@ msgstr ""
 "section [nss], soit par domaine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr "Par défaut : indéfini (SSSD utilisera la valeur récupérée de LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1556,14 +1541,14 @@ msgstr ""
 "indiquées. L'ordre d'évaluation est :"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 "1. Si l'interpréteur de commandes est présent dans <quote>/etc/shells</"
 "quote>, il est utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1573,7 +1558,7 @@ msgstr ""
 "shell_fallback » sera utilisée."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1582,12 +1567,12 @@ msgstr ""
 "ni dans <quote>/etc/shells</quote>, une connexion sans shell est utilisée."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1595,14 +1580,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 "Une chaîne vide pour l'interpréteur de commandes est passée telle quelle est "
 "à la libc."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1612,31 +1597,31 @@ msgstr ""
 "est installé."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 "Par défaut : non défini. L'interpréteur de commandes de l'utilisateur est "
 "utilisé automatiquement."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 "Remplace toutes les occurences de ces interpréteurs de commandes par "
 "l'interpréteur de commandes par défaut"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1644,17 +1629,17 @@ msgstr ""
 "commandes autorisé n'est pas installé sur la machine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Par défaut : /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1664,7 +1649,7 @@ msgstr ""
 "choix soit dans la section [nss], soit par domaine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1674,12 +1659,12 @@ msgstr ""
 "nécessaire, habituellement /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (int)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1688,43 +1673,43 @@ msgstr ""
 "jugée valide."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "enum_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "enum_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1732,27 +1717,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr "Par défaut : 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "enum_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1760,21 +1745,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Par défaut : 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "enum_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1782,14 +1767,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "enum_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1798,12 +1783,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1814,38 +1799,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr "Par défaut : non défini, repli sur l'option InfoPipe"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>permit</quote>"
 msgid "Default: <quote>*</quote>"
 msgstr "Par défaut : <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 #, fuzzy
 #| msgid "This option can also be set per-domain."
 msgid ""
@@ -1854,7 +1839,7 @@ msgid ""
 msgstr "Cette option peut aussi être définie pour chaque domaine."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1863,12 +1848,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "Options de configuration de PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -1877,12 +1862,12 @@ msgstr ""
 "Module (PAM)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -1892,17 +1877,17 @@ msgstr ""
 "connexion réussie)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Par défaut : 0 (pas de limite)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -1911,12 +1896,12 @@ msgstr ""
 "échouées sont autorisées."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -1926,7 +1911,7 @@ msgstr ""
 "soit possible."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1937,17 +1922,17 @@ msgstr ""
 "connexion réussie en ligne peut réactiver l'authentification."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Par défaut : 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -1957,46 +1942,46 @@ msgstr ""
 "affichés sera important."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "Actuellement sssd supporte les valeurs suivantes :"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis> : ne pas afficher de message"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis> : afficher seulement les messages importants"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis> : afficher les messages d'information"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis> : afficher tous les messages et informations de "
 "débogage"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Par défaut : 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "ad_access_filter (string)"
 msgid "pam_response_filter (string)"
 msgstr "ad_access_filter (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2005,51 +1990,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2060,23 +2045,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2088,7 +2073,7 @@ msgstr ""
 "les dernières informations."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2102,17 +2087,17 @@ msgstr ""
 "fournisseur d'identité."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "Afficher une alerte N jours avant l'expiration du mot de passe."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2123,7 +2108,7 @@ msgstr ""
 "ne peut afficher de message d'alerte."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2133,7 +2118,7 @@ msgstr ""
 "sera automatiquement affiché."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2142,17 +2127,18 @@ msgstr ""
 "<emphasis>pwd_expiration_warning</emphasis> pour un domaine particulier."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Par défaut : 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2162,37 +2148,37 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 "Deux valeurs spéciales pour l'option pam_public_domains sont définies :"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
@@ -2200,7 +2186,7 @@ msgstr ""
 "à tous les domaines PAM dans le répondeur.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2209,33 +2195,33 @@ msgstr ""
 "autorisés à accéder à un des domaines PAM dans le répondeur.)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Par défaut : aucun"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2243,19 +2229,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2263,48 +2249,48 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 #, fuzzy
 #| msgid "ldap_chpass_update_last_change (bool)"
 msgid "pam_passkey_auth (bool)"
 msgstr "ldap_chpass_update_last_change (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Par défaut : True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Par défaut : False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2312,36 +2298,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "ldap_user_certificate (string)"
 msgid "pam_cert_verification (string)"
 msgstr "ldap_user_certificate (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2351,7 +2337,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, fuzzy, no-wrap
 #| msgid ""
 #| "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -2364,63 +2350,63 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "pam_id_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "ad_gpo_map_service (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "ad_gpo_map_service (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2428,7 +2414,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2440,63 +2426,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2504,12 +2490,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2520,7 +2506,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2528,7 +2514,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2536,7 +2522,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2545,47 +2531,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2594,19 +2580,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 #, fuzzy
 #| msgid "ad_gpo_map_service (string)"
 msgid "pam_gssapi_services"
 msgstr "ad_gpo_map_service (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 #, fuzzy
 #| msgid "Comma separated list of users who are allowed to log in."
 msgid ""
@@ -2616,13 +2602,13 @@ msgstr ""
 "Liste séparée par des virgules d'utilisateurs autorisés à se connecter."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2630,7 +2616,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, fuzzy, no-wrap
 #| msgid ""
 #| "fallback_homedir = /home/%u\n"
@@ -2643,22 +2629,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Exemple : <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2666,19 +2652,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2686,7 +2672,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2701,7 +2687,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2709,45 +2695,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2755,7 +2741,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2763,7 +2749,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 #, fuzzy
 #| msgid "Default: not set (no substitution for unset home directories)"
 msgid "Default: not set (use of authentication indicators is not required)"
@@ -2772,12 +2758,12 @@ msgstr ""
 "non définis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "Options de configuration de SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2794,12 +2780,12 @@ msgstr ""
 "sudo</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -2808,12 +2794,12 @@ msgstr ""
 "les entrées sudoers sensibles au temps."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2823,22 +2809,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "Options de configuration AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr "Ces options peuvent être utilisées pour configurer le service autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2850,23 +2836,23 @@ msgstr ""
 "moteur."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "Options de configuration SSH"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 "Les options suivantes peuvent être utilisées pour configurer le service SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -2874,12 +2860,12 @@ msgstr ""
 "Condenser ou non les noms de systèmes et adresses du fichier known_hosts"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -2888,17 +2874,17 @@ msgstr ""
 "known_hosts géré après que ses clés de système ont été demandés."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "Par défaut : 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2907,12 +2893,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2922,7 +2908,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2930,7 +2916,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2939,38 +2925,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "Options de configuration du répondeur PAC"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2981,7 +2967,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2992,7 +2978,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3001,19 +2987,19 @@ msgstr ""
 "ajouté à ces groupes."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 "Les options suivantes peuvent être utilisées pour configurer le répondeur "
 "PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3024,7 +3010,7 @@ msgstr ""
 "seront résolus en UID au démarrage."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 #, fuzzy
 #| msgid ""
 #| "Default: 0 (only the root user is allowed to access the PAC responder)"
@@ -3036,14 +3022,14 @@ msgstr ""
 "PAC)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "Par défaut : 0 (seul l'utilisateur root est autorisé à accéder au répondeur "
 "PAC)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 #, fuzzy
 #| msgid ""
 #| "Please note that although the UID 0 is used as the default it will be "
@@ -3062,7 +3048,7 @@ msgstr ""
 "0 à la liste des UID d'utilisateurs autorisés."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3075,26 +3061,26 @@ msgstr ""
 "0 à la liste des UID d'utilisateurs autorisés."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "ldap_schema (string)"
 msgid "pac_check (string)"
 msgstr "ldap_schema (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3105,24 +3091,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3130,24 +3116,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3159,7 +3145,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3170,41 +3156,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -3217,19 +3203,19 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3239,66 +3225,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3306,17 +3292,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3324,7 +3310,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3333,65 +3319,65 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "exclude_users (string)"
 msgstr "simple_deny_users (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No users excluded."
 msgstr "Par défaut : vide, ldap_uri est donc utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "simple_deny_groups (string)"
 msgid "exclude_groups (string)"
 msgstr "simple_deny_groups (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No groups excluded."
 msgstr "Par défaut : vide, ldap_uri est donc utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "SECTIONS DOMAINES"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3401,12 +3387,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3415,14 +3401,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3431,31 +3417,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3464,7 +3450,7 @@ msgstr ""
 "dehors de ces limites, elle est ignorée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3477,7 +3463,7 @@ msgstr ""
 "qui sont dans la plage seront rapportés comme prévu."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3486,17 +3472,17 @@ msgstr ""
 "pas seulement leur recherche par nom ou identifiant."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Default: 1 for min_id, 0 (no limit) for max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3505,36 +3491,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = utilisateurs et groupes sont énumérés"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = aucune énumération pour ce domaine"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Par défaut : FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3548,7 +3534,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3558,7 +3544,7 @@ msgstr ""
 "l'énumération ne se termine."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3572,7 +3558,7 @@ msgstr ""
 "fournisseur d'identité spécifique utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -3581,7 +3567,7 @@ msgstr ""
 "déconseillée, surtout dans les environnements de grande taille."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3589,32 +3575,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Tous les domaines approuvés découverts seront énumérés"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Aucun domaine approuvé découvert ne sera énuméré"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3628,12 +3614,12 @@ msgstr ""
 "activer l'énumération pour ces seuls domaines."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -3642,7 +3628,7 @@ msgstr ""
 "comme valides avant de les redemander au moteur"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3660,17 +3646,17 @@ msgstr ""
 "rafraîchissement des entrées qui sont déjà en cache."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Par défaut : 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -3679,19 +3665,19 @@ msgstr ""
 "d'utilisateurs comme valides avant de les redemander au moteur."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "Par défaut : entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -3700,12 +3686,12 @@ msgstr ""
 "groupes comme valides avant de les redemander au moteur."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -3714,12 +3700,12 @@ msgstr ""
 "netgroup comme valides avant de les redemander au moteur."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -3728,24 +3714,24 @@ msgstr ""
 "service valides avant de les redemander au moteur"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -3754,12 +3740,12 @@ msgstr ""
 "valides avant de les redemander au moteur"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -3768,12 +3754,12 @@ msgstr ""
 "cartes d'automontage comme valides avant de les redemander au moteur"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -3782,24 +3768,24 @@ msgstr ""
 "rafraichissement. I.e. combien de temps mettre la clé en cache."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -3809,7 +3795,7 @@ msgstr ""
 "enregistrements expirés ou sur le point de l'être."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3818,18 +3804,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 "Il est envisageable de configurer cette valeur à 3/4 * entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3841,18 +3827,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "Par défaut : 0 (désactivé)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3863,7 +3849,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3872,12 +3858,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3885,19 +3871,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3910,17 +3896,17 @@ msgstr ""
 "paramètre doit être supérieur ou égal à offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Par défaut : 0 (illimité)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3933,17 +3919,17 @@ msgstr ""
 "fournisseur oauth doit être configuré pour le moteur."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Par défaut : 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -3951,12 +3937,12 @@ msgstr ""
 "d'identification pris en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3964,7 +3950,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3976,8 +3962,8 @@ msgstr ""
 "LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 #, fuzzy
 #| msgid ""
 #| "<quote>ipa</quote>: FreeIPA and Red Hat Enterprise Identity Management "
@@ -3995,8 +3981,8 @@ msgstr ""
 "configuration de FreeIPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4008,12 +3994,12 @@ msgstr ""
 "d'Active Directory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4023,7 +4009,7 @@ msgstr ""
 "communiqué à NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4037,7 +4023,7 @@ msgstr ""
 "trouve."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4049,24 +4035,24 @@ msgstr ""
 "qualifié sera demandé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr "Ne pas envoyer les membres des groupes sur les recherches de groupes."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4078,7 +4064,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4086,23 +4072,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4111,7 +4097,7 @@ msgstr ""
 "pris en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4123,7 +4109,7 @@ msgstr ""
 "LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4134,7 +4120,7 @@ msgstr ""
 "citerefentry> pour plus d'informations sur la configuration de Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
@@ -4142,12 +4128,12 @@ msgstr ""
 "PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> désactive l'authentification explicitement."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4156,12 +4142,12 @@ msgstr ""
 "gérer les requêtes d'authentification."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4172,7 +4158,7 @@ msgstr ""
 "installés). Les fournisseurs internes spécifiques sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4181,12 +4167,12 @@ msgstr ""
 "d'accès autorisé pour un domaine local."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> toujours refuser les accès."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4199,7 +4185,7 @@ msgstr ""
 "d'informations sur la configuration du module d'accès simple."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4207,22 +4193,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Par défaut : <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4231,7 +4217,7 @@ msgstr ""
 "domaine. Les fournisseurs pris en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4239,7 +4225,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4251,7 +4237,7 @@ msgstr ""
 "Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
@@ -4259,14 +4245,14 @@ msgstr ""
 "autre cible PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 "<quote>none</quote> pour désactiver explicitement le changement de mot de "
 "passe."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4275,19 +4261,19 @@ msgstr ""
 "peut gérer les changements de mot de passe."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "Le fournisseur SUDO, utilisé pour le domaine.  Les fournisseurs SUDO pris en "
 "charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4299,7 +4285,7 @@ msgstr ""
 "LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4308,7 +4294,7 @@ msgstr ""
 "par défaut pour IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4317,20 +4303,20 @@ msgstr ""
 "par défaut pour AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> désactive explicitement SUDO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "Par défaut : La valeur de <quote>id_provider</quote> est utilisée si elle "
 "est définie."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4341,7 +4327,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4350,12 +4336,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4366,7 +4352,7 @@ msgstr ""
 "fournisseur d'accès.  Les fournisseurs selinux pris en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4378,14 +4364,14 @@ msgstr ""
 "IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 "<quote>none</quote> n'autorise pas la récupération explicite des paramètres "
 "selinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4394,12 +4380,12 @@ msgstr ""
 "gérer le chargement selinux"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4409,7 +4395,7 @@ msgstr ""
 "fournisseurs de sous-domaine pris en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4421,7 +4407,7 @@ msgstr ""
 "IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4430,18 +4416,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 "<quote>none</quote> désactive la récupération explicite des sous-domaines."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4449,30 +4435,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -4480,7 +4466,7 @@ msgstr ""
 "en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4492,7 +4478,7 @@ msgstr ""
 "LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4504,7 +4490,7 @@ msgstr ""
 "IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4512,17 +4498,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> désactive explicitement autofs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -4531,7 +4517,7 @@ msgstr ""
 "systèmes.  Les fournisseurs de hostid pris en charge sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4543,31 +4529,31 @@ msgstr ""
 "configuration de IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> désactive explicitement hostid."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4575,7 +4561,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4584,12 +4570,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4605,7 +4591,7 @@ msgstr ""
 "domaine."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 #, fuzzy
 #| msgid ""
 #| "Default for the AD and IPA provider: <quote>(((?P&lt;domain&gt;[^\\\\]+)\\"
@@ -4622,17 +4608,17 @@ msgstr ""
 "styles différents pour les noms d'utilisateurs :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "username@domain.name"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 #, fuzzy
 #| msgid ""
 #| "Default for the AD and IPA provider: <quote>(((?P&lt;domain&gt;[^\\\\]+)\\"
@@ -4651,12 +4637,12 @@ msgstr ""
 "styles différents pour les noms d'utilisateurs :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "domain\\username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -4666,7 +4652,7 @@ msgstr ""
 "utilisateurs de domaines Windows."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4676,17 +4662,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Par défaut : <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -4695,95 +4681,100 @@ msgstr ""
 "utiliser pour effectuer les requêtes DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Valeurs prises en charge :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first : essayer de chercher une adresse IPv4, et en cas d'échec, "
 "essayer IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 "ipv4_only : ne tenter de résoudre les noms de systèmes qu'en adresses IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first : essayer de chercher une adresse IPv6, et en cas d'échec, tenter "
 "IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 "ipv6_only : ne tenter de résoudre les noms de systèmes qu'en adresses IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Par défaut : ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Par défaut : 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Par défaut : 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4792,14 +4783,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4807,7 +4798,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4815,17 +4806,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Par défaut : TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -4834,21 +4825,21 @@ msgstr ""
 "du domaine faisant partie de la requête DNS de découverte de services."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 "Par défaut : utiliser la partie du domaine qui est dans le nom de système de "
 "la machine."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "pam_id_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4856,59 +4847,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Par défaut : 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "Redéfinit le GID primaire avec la valeur spécifiée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr "Insensible à la casse."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4920,14 +4911,14 @@ msgstr ""
 "sortie."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -4940,17 +4931,17 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr "Par défaut : true (false pour le fournisseur AD)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4958,130 +4949,130 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_search_timeout (integer)"
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "ldap_network_timeout (integer)"
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "ldap_connection_expire_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout"
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 #, fuzzy
 #| msgid "ldap_krb5_ticket_lifetime (integer)"
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "ldap_enumeration_search_timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_expire_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 #, fuzzy
 #| msgid "Case insensitive."
 msgid "case_sensitive"
 msgstr "Insensible à la casse."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5091,27 +5082,27 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "nom plat (NetBIOS) d'un sous-domaine."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5127,7 +5118,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5135,17 +5126,17 @@ msgstr ""
 "emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Par défaut : <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
@@ -5153,12 +5144,12 @@ msgstr ""
 "ce domaine."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5167,19 +5158,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5187,14 +5178,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy (string)"
 msgstr "ldap_pwd_policy (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5206,7 +5197,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5218,7 +5209,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5226,44 +5217,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_pwd_policy (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5272,7 +5263,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5283,7 +5274,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5291,38 +5282,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: cn"
 msgid "Default: match"
 msgstr "Par défaut : cn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5331,24 +5322,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5358,14 +5349,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5373,21 +5364,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5395,7 +5386,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5404,7 +5395,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5413,7 +5404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -5425,17 +5416,17 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "Le proxy cible duquel PAM devient mandataire."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 #, fuzzy
 #| msgid ""
 #| "Default: not set by default, you have to take an existing pam "
@@ -5449,12 +5440,12 @@ msgstr ""
 "ou en créer une nouvelle et ajouter le nom de service ici."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -5465,12 +5456,12 @@ msgstr ""
 "_nss_$(libName)_$(function), par exemple _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -5478,12 +5469,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -5497,12 +5488,12 @@ msgstr ""
 "afin d'améliorer les performances."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -5510,7 +5501,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -5519,12 +5510,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5541,7 +5532,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5549,17 +5540,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5568,7 +5559,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5578,7 +5569,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5598,12 +5589,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5614,69 +5605,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5689,7 +5680,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5697,7 +5688,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5706,55 +5697,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5763,17 +5754,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5781,26 +5772,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5809,17 +5800,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5829,7 +5820,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5838,59 +5829,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5899,7 +5890,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5907,18 +5898,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5926,39 +5928,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -5971,7 +5973,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5980,7 +5982,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5988,12 +5990,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[sssd]\n"
@@ -6071,7 +6073,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6080,7 +6082,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6088,7 +6090,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6099,7 +6101,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6110,7 +6112,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -6316,7 +6318,7 @@ msgstr ""
 "http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Exemples :"
@@ -6794,7 +6796,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "Par défaut : 900 (15 minutes)"
 
@@ -7107,7 +7109,7 @@ msgstr ""
 "certification que <command>sssd</command> reconnaîtra."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -7122,11 +7124,19 @@ msgstr "ldap_tls_cacertdir (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "Spécifie le chemin d'un dossier qui contient les certificats de l'autorité "
 "de certificats dans des fichiers séparés. Usuellement, les noms de fichiers "
@@ -7135,32 +7145,32 @@ msgstr ""
 "corrects."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr "Définit le fichier qui contient le certificat pour la clef du client."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "Définit le fichier qui contient la clef du client."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -7168,12 +7178,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 #, fuzzy
 #| msgid ""
 #| "Specifies that the id_provider connection must also use <systemitem "
@@ -7188,12 +7198,12 @@ msgstr ""
 "canal."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -7205,19 +7215,19 @@ msgstr ""
 "ldap_group_gid_number."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "Cette fonctionnalité ne prend actuellement en charge que la correspondance "
 "par objectSID avec Active Directory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -7237,24 +7247,24 @@ msgstr ""
 "identifiants."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr "Par défaut : non indiqué (les deux options sont à 0)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -7265,12 +7275,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -7283,7 +7293,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -7295,17 +7305,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "Par défaut : host/hostname@REALM"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -7316,17 +7326,17 @@ msgstr ""
 "domaine, cette option est ignorée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "Par défaut : la valeur de krb5_realm."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -7335,34 +7345,34 @@ msgstr ""
 "le nom de l'hôte au cours d'une liaison SASL."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Défaut : false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Par défaut : le fichier keytab du système, normalement <filename>/etc/krb5."
 "keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -7370,28 +7380,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Par défaut : 86400 (24 heures)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -7411,7 +7421,7 @@ msgstr ""
 "<quote>DÉCOUVERTE DE  SERVICES</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -7422,7 +7432,7 @@ msgstr ""
 "comme protocole, et passe sur _tcp si aucune entrée n'est trouvée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -7434,29 +7444,29 @@ msgstr ""
 "l'utilisation de <quote>krb5_server</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 "Par défaut : valeur par défaut du système, voir <filename>/etc/krb5.conf</"
 "filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -7466,12 +7476,12 @@ msgstr ""
 "Kerberos > = 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -7486,7 +7496,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -7498,12 +7508,12 @@ msgstr ""
 "localisation."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -7512,7 +7522,7 @@ msgstr ""
 "valeurs suivantes sont acceptées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -7521,7 +7531,7 @@ msgstr ""
 "peut pas désactiver la politique sur les mots de passe du côté serveur."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 #, fuzzy
 #| msgid ""
 #| "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
@@ -7538,7 +7548,7 @@ msgstr ""
 "manvolnum></citerefentry> pour évaluer si le mot de passe a expiré."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -7550,7 +7560,7 @@ msgstr ""
 "est changé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
@@ -7559,17 +7569,17 @@ msgstr ""
 "côté serveur, elle prend le pas sur la politique indiquée avec cette option."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr "Définit si le déréférencement automatique doit être activé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -7578,7 +7588,7 @@ msgstr ""
 "compilé avec OpenLDAP version 2.4.13 ou supérieur."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 #, fuzzy
 #| msgid ""
 #| "Chasing referrals may incur a performance penalty in environments that "
@@ -7602,29 +7612,29 @@ msgstr ""
 "permettre d'améliorer de façon notable les performances."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "Définit le nom de service à utiliser quand la découverte de services est "
 "activée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Par défaut : ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -7633,19 +7643,19 @@ msgstr ""
 "un changement de mot de passe quand la découverte de services est activée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 "Par défaut : non défini, c'est-à-dire que le service de découverte est "
 "désactivé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
@@ -7655,7 +7665,7 @@ msgstr ""
 "de passe."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -7664,12 +7674,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -7685,12 +7695,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Exemple :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7702,7 +7712,7 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
@@ -7711,7 +7721,7 @@ msgstr ""
 "dont l'attribut employeeType est « admin »."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -7720,17 +7730,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "Par défaut : vide"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -7739,7 +7749,7 @@ msgstr ""
 "être activée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -7751,12 +7761,12 @@ msgstr ""
 "correct."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Les valeurs suivantes sont autorisées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -7765,7 +7775,7 @@ msgstr ""
 "pour déterminer si le compte a expiré."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -7778,7 +7788,7 @@ msgstr ""
 "d'expiration du compte est aussi vérifiée."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -7789,7 +7799,7 @@ msgstr ""
 "l'accès est autorisé ou non."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -7802,7 +7812,7 @@ msgstr ""
 "est autorisé. Si les deux attributs sont manquants, l'accès est autorisé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -7813,24 +7823,24 @@ msgstr ""
 "ldap_account_expire_policy de fonctionner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "Liste séparées par des virgules des options de contrôles d'accès. Les "
 "valeurs autorisées sont :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis> : utiliser ldap_access_filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7840,14 +7850,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7860,12 +7870,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>expire</emphasis>: utiliser ldap_account_expire_policy"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -7875,38 +7885,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -7915,32 +7926,32 @@ msgstr ""
 "authorizedService pour déterminer l'accès"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis> : utilise l'attribut host pour déterminer l'accès"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Par défaut : filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -7949,12 +7960,12 @@ msgstr ""
 "de configuration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr "ldap_pwdlockout_dn (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7963,22 +7974,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr "Exemple : cn=ppolicy,ou=policies,dc=example,dc=com"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (chaînes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -7987,12 +7998,12 @@ msgstr ""
 "recherche. Les options suivantes sont autorisées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr "<emphasis>never</emphasis> : les alias ne sont jamais déréférencés."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -8002,7 +8013,7 @@ msgstr ""
 "recherche."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -8011,7 +8022,7 @@ msgstr ""
 "la localisation de l'objet de base de la recherche."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -8020,7 +8031,7 @@ msgstr ""
 "recherche et et la localisation de l'objet de base de la recherche."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -8029,12 +8040,12 @@ msgstr ""
 "bibliothèques clientes LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -8043,7 +8054,7 @@ msgstr ""
 "LDAP pour les serveurs qui utilisent le schéma RFC2307."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -8061,7 +8072,7 @@ msgstr ""
 "initgoups()."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -8072,70 +8083,88 @@ msgstr ""
 "ajoutent les utilisateurs locaux aux groupes LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "debug_level (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "debug_level (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 #, fuzzy
 #| msgid "Default: 0 (disabled)"
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "Par défaut : 0 (désactivé)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "ldap_id_mapping (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_id_mapping (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (entier)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -8149,12 +8178,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "OPTIONS DE SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -8162,12 +8191,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
@@ -8177,7 +8206,7 @@ msgstr ""
 "règles qui sont stockées sur le serveur)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -8186,24 +8215,24 @@ msgstr ""
 "emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "Par défaut : 21600 (6 heures)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -8211,7 +8240,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
@@ -8220,7 +8249,7 @@ msgstr ""
 "modifyTimestamp est utilisé à la place."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -8230,21 +8259,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_idmap_range_size (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -8252,7 +8281,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -8260,17 +8289,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
@@ -8280,12 +8309,12 @@ msgstr ""
 "noms de systèmes)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -8294,7 +8323,7 @@ msgstr ""
 "doivent être utilisés pour filtrer les règles."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
@@ -8303,8 +8332,8 @@ msgstr ""
 "nom de système et le nom de domaine pleinement qualifié."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -8313,17 +8342,17 @@ msgstr ""
 "emphasis>, alors cette option n'a aucun effet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "Par défaut : non spécifié"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -8332,7 +8361,7 @@ msgstr ""
 "IPv6 qui doivent être utilisés pour filtrer les règles."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -8341,12 +8370,12 @@ msgstr ""
 "automatiquement."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
@@ -8355,12 +8384,12 @@ msgstr ""
 "netgroup dans l'attribut sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
@@ -8369,14 +8398,14 @@ msgstr ""
 "un joker dans l'attribut sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -8389,59 +8418,59 @@ msgstr ""
 "manvolnum></citerefentry>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "OPTIONS AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "Le nom de la table de montage automatique maîtresse dans LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "Par défaut : auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "OPTIONS AVANCÉES"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (chaînes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (chaînes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (chaînes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr "<note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -8450,22 +8479,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr "</note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -8474,14 +8503,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "EXEMPLE"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -8492,7 +8521,7 @@ msgstr ""
 "replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8512,27 +8541,27 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8558,13 +8587,13 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTES"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -10930,7 +10959,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (booléen)"
 
@@ -10945,7 +10974,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -10967,12 +10996,12 @@ msgstr ""
 "configuration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -10999,12 +11028,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Par défaut : 1200 (secondes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -11032,17 +11061,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -11050,19 +11079,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 #, fuzzy
 #| msgid "dyndns_iface (string)"
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_iface (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -11070,7 +11099,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -11105,7 +11134,7 @@ msgstr ""
 "seront utilisés comme serveurs de repli"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (entier)"
 
@@ -11122,12 +11151,12 @@ msgstr ""
 "configurée à true."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -11147,7 +11176,7 @@ msgstr ""
 "quand les enregistrements directs sont modifiés."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -11159,12 +11188,12 @@ msgid "Default: False (disabled)"
 msgstr "Par défaut : False (désactivé)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -11173,48 +11202,48 @@ msgstr ""
 "communication avec le serveur DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Par défaut : False (laisser nsupdate choisir le protocole)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -11387,26 +11416,26 @@ msgstr ""
 "convertit en DN de base pour effectuer les opérations LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr "krb5_confd_path (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -11425,7 +11454,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "Par défaut : 5 (secondes)"
 
@@ -12187,14 +12216,16 @@ msgstr "ad_access_filter (chaîne)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -12203,7 +12234,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -12212,14 +12243,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -12232,7 +12263,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -12241,7 +12272,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -12259,24 +12290,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr "ad_site (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -12285,7 +12316,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -12294,12 +12325,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -12309,7 +12340,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -12318,7 +12349,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -12327,7 +12358,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -12337,21 +12368,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -12361,7 +12392,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -12376,23 +12407,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr "Il existe trois valeurs prises en charge pour cette option :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -12400,22 +12431,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "Par défaut : permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -12426,7 +12457,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -12434,82 +12465,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "all users are allowed"
 msgstr "Les valeurs suivantes sont autorisées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "only users in allow-rules are allowed"
 msgstr "Les valeurs suivantes sont autorisées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 #, fuzzy
 #| msgid "ad_gpo_map_deny (string)"
 msgid "ad_gpo_implicit_deny = True"
 msgstr "ad_gpo_map_deny (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "no users are allowed"
 msgstr "Les valeurs suivantes sont autorisées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -12519,12 +12550,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr "ad_gpo_cache_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -12532,12 +12563,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr "ad_gpo_map_interactive (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -12553,14 +12584,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -12568,7 +12599,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12580,42 +12611,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr "ad_gpo_map_remote_interactive (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -12631,7 +12662,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -12639,7 +12670,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -12647,7 +12678,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12659,22 +12690,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr "ad_gpo_map_network (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -12690,7 +12721,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -12698,7 +12729,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -12706,7 +12737,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12718,22 +12749,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr "ad_gpo_map_batch (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -12748,14 +12779,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -12763,7 +12794,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12775,23 +12806,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr "ad_gpo_map_service (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -12807,14 +12838,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -12822,7 +12853,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -12833,19 +12864,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr "ad_gpo_map_permit (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -12853,7 +12884,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12865,29 +12896,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr "ad_gpo_map_deny (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -12895,12 +12926,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr "ad_gpo_default_right (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -12913,52 +12944,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -12966,17 +12997,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -12986,17 +13017,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -13005,12 +13036,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -13021,14 +13052,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 #, fuzzy
 #| msgid "ldap_sudo_include_netgroups (boolean)"
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ldap_sudo_include_netgroups (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -13039,7 +13070,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -13054,7 +13085,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -13066,7 +13097,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -13084,19 +13115,19 @@ msgstr ""
 "<quote>dyndns_iface</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "Par défaut : 3600 (secondes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -13106,7 +13137,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -13117,7 +13148,7 @@ msgstr ""
 "exemples montrent seulement les options spécifiques au fournisseur AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -13141,7 +13172,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -13153,7 +13184,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -13164,7 +13195,7 @@ msgstr ""
 "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -13174,7 +13205,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -13766,76 +13797,89 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr "CODE RETOUR"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 #, fuzzy
 #| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
 msgstr "Options de configuration NSS"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -15868,7 +15912,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -15905,8 +15949,59 @@ msgstr ""
 "Rechercher les clés publiques dans le domaine SSSD <replaceable>DOMAINE</"
 "replaceable> hôte."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-R</option>,<option>--no-remove</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-R</option>,<option>--no-remove</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 #, fuzzy
 #| msgid ""
 #| "In case of success, an exit value of 0 is returned. Otherwise, 1 is "
@@ -19914,14 +20009,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -20543,6 +20637,17 @@ msgstr ""
 "rendus canoniques. Cette fonctionnalité est disponible avec MIT Kerberos 1.7 "
 "et versions suivantes."
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (entier)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Nombre d'essais de reconnection ou de redémarrage que les services "
+#~ "doivent effectuer dans le cas d'un plantage du fournisseur de données "
+#~ "avant d'abandonner"
+
 #, fuzzy
 #~| msgid "This option is not available in IPA provider."
 #~ msgid "This option is ignored for the files provider."
@@ -20965,9 +21070,6 @@ msgstr ""
 #~ "l'utilisateur et sa messagerie seront supprimés. Outrepasse la "
 #~ "configuration."
 
-#~ msgid "<option>-R</option>,<option>--no-remove</option>"
-#~ msgstr "<option>-R</option>,<option>--no-remove</option>"
-
 #~ msgid ""
 #~ "Files in the user's home directory will NOT be removed along with the "
 #~ "home directory itself and the user's mail spool. Overrides the "
diff --git a/src/man/po/ja.po b/src/man/po/ja.po
index ece3b163343..0c582a45670 100644
--- a/src/man/po/ja.po
+++ b/src/man/po/ja.po
@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2021-07-20 07:04+0000\n"
 "Last-Translator: Ludek Janda <ljanda@redhat.com>\n"
 "Language-Team: Japanese <https://translate.fedoraproject.org/projects/sssd/"
@@ -234,13 +234,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "初期値: true"
 
@@ -257,11 +257,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "初期値: false"
@@ -296,8 +296,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -327,8 +327,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "初期値: 10"
 
@@ -364,48 +364,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (整数)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"データプロバイダーがクラッシュまたは再起動した場合、サービスが再接続をあきら"
-"める前に試行する回数です。"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "初期値: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domains"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -416,19 +395,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -436,12 +415,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -452,39 +431,39 @@ msgstr ""
 "manvolnum> </citerefentry> 互換形式。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "ユーザー名"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr "SSSD 設定ファイルにおいて指定されるドメイン名。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -493,19 +472,19 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -514,12 +493,12 @@ msgstr ""
 "conf の状態を監視するかどうかを制御します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -527,7 +506,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -538,7 +517,7 @@ msgstr ""
 "です"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -547,7 +526,7 @@ msgstr ""
 "トフォームにおいては偽です。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -556,12 +535,12 @@ msgstr ""
 "ません。これらのプラットフォームにおいては、ポーリングが常に使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -570,7 +549,7 @@ msgstr ""
 "クトリーです。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -579,7 +558,7 @@ msgstr ""
 "よう SSSD に指示する、特別な値 __LIBKRB5_DEFAULTS__ を受け付けます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -588,12 +567,12 @@ msgstr ""
 "ければ __LIBKRB5_DEFAULTS__ です)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -601,14 +580,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -618,17 +597,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -638,7 +617,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -651,8 +630,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -660,12 +639,12 @@ msgid "Default: not set"
 msgstr "初期値: 設定されません"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -675,7 +654,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -684,22 +663,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -707,12 +686,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -720,61 +699,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -782,12 +761,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -795,24 +774,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 #, fuzzy
 #| msgid ""
 #| "Please refer to the <quote>dns_discovery_domain</quote> parameter in the "
@@ -829,12 +808,12 @@ msgstr ""
 "<quote>dns_discovery_domain</quote> パラメーターを参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -843,7 +822,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -851,58 +830,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -913,7 +892,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -931,20 +910,20 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 #, fuzzy
 #| msgid "ipa_server_mode (boolean)"
 msgid "implicit_pac_responder (boolean)"
 msgstr "ipa_server_mode (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -952,14 +931,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 #, fuzzy
 #| msgid "dyndns_update (boolean)"
 msgid "core_dumpable (boolean)"
 msgstr "dyndns_update (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -967,28 +946,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "ipa_automount_location (string)"
 msgid "passkey_verification (string)"
 msgstr "ipa_automount_location (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "ipa_automount_location (string)"
 msgid "user_verification (boolean)"
 msgstr "ipa_automount_location (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -996,7 +975,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -1026,12 +1005,12 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "サービスセクション"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1043,22 +1022,22 @@ msgstr ""
 "ば、NSS サービスは <quote>[nss]</quote> セクションです"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "サービス設定の全体オプション"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "これらのオプションはすべてのサービスを設定するために使用できます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1068,17 +1047,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1088,19 +1067,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 60, KCM: 300"
 msgstr "初期値: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1111,14 +1090,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1126,46 +1105,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "初期値: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1174,64 +1153,64 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "初期値: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "offline_failed_login_attempts (integer)"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_failed_login_attempts (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "初期値: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1243,30 +1222,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "初期値: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "NSS 設定オプション"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1274,12 +1253,12 @@ msgstr ""
 "きます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1288,17 +1267,17 @@ msgstr ""
 "要求）。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "初期値: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1309,7 +1288,7 @@ msgstr ""
 "す。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1324,7 +1303,7 @@ msgstr ""
 "とをブロックする必要がありません。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1337,17 +1316,17 @@ msgstr ""
 "（0 はこの機能を無効にします）"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "初期値: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1358,17 +1337,17 @@ msgstr ""
 "せ）をキャッシュする秒数を指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "初期値: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1376,17 +1355,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1395,7 +1374,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1404,17 +1383,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "初期値: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1422,12 +1401,12 @@ msgstr ""
 "ションを偽に設定します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1436,7 +1415,7 @@ msgstr ""
 "ホームディレクトリーの標準テンプレートを設定します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1444,7 +1423,7 @@ msgstr ""
 "同じです。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1454,23 +1433,23 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "例: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr "初期値: 設定なし (ホームディレクトリーの設定がない場合は代替なし)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1478,17 +1457,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr "初期値: 設定なし (SSSD は LDAP から取得された値を使用します)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1496,13 +1475,13 @@ msgstr ""
 "す:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 "1. シェルが <quote>/etc/shells</quote> に存在すると、それが使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1511,7 +1490,7 @@ msgstr ""
 "ば、shell_fallback パラメーターの値を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1520,12 +1499,12 @@ msgstr ""
 "ば、nologin シェルが使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1533,12 +1512,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "シェルの空文字列は libc にそのまま渡されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1548,27 +1527,27 @@ msgstr ""
 "ます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr "初期値: 設定されません。ユーザーシェルが自動的に使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "これらのシェルのインスタンスをすべて shell_fallback に置き換えます"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1576,79 +1555,79 @@ msgstr ""
 "す。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "初期値: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr "サブドメインのリストが有効とみなされる時間を秒単位で指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "enum_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "enum_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1656,27 +1635,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "enum_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1684,21 +1663,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "初期値: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "enum_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1706,14 +1685,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "enum_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1722,12 +1701,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1738,38 +1717,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>permit</quote>"
 msgid "Default: <quote>*</quote>"
 msgstr "初期値: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 #, fuzzy
 #| msgid "This option can also be set per-domain."
 msgid ""
@@ -1778,7 +1757,7 @@ msgid ""
 msgstr "このオプションはドメインごとに設定できます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1787,12 +1766,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "PAM 設定オプション"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -1801,12 +1780,12 @@ msgstr ""
 "ために使用できます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -1815,17 +1794,17 @@ msgstr ""
 "ラインログインの最終成功からの日数）です。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "初期値: 0 (無制限)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -1833,12 +1812,12 @@ msgstr ""
 "認証プロバイダーがオフラインの場合、ログイン試行の失敗が許容される回数です。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -1847,7 +1826,7 @@ msgstr ""
 "渡される分単位の時間です。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1858,17 +1837,17 @@ msgstr ""
 "効にできます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "初期値: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -1877,44 +1856,44 @@ msgstr ""
 "きいほどメッセージが表示されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "現在 sssd は以下の値をサポートします:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: 何もメッセージを表示しない"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: 重要なメッセージのみを表示する"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: 情報レベルのメッセージを表示する"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr "<emphasis>3</emphasis>: すべてのメッセージとデバッグ情報を表示する"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "初期値: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "ldap_access_filter (string)"
 msgid "pam_response_filter (string)"
 msgstr "ldap_access_filter (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1923,51 +1902,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1978,23 +1957,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2004,7 +1983,7 @@ msgstr ""
 "されるよう、SSSD は直ちにキャッシュされた識別情報を更新しようとします。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2017,17 +1996,17 @@ msgstr ""
 "アプリケーションごとに）制御します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "パスワードの期限が切れる前に N 日間警告を表示します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2037,31 +2016,32 @@ msgstr ""
 "ことに注意してください。この情報がなければ、sssd は警告を表示します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "初期値: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2071,75 +2051,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "初期値: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2147,19 +2127,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2167,48 +2147,48 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 #, fuzzy
 #| msgid "ldap_chpass_update_last_change (bool)"
 msgid "pam_passkey_auth (bool)"
 msgstr "ldap_chpass_update_last_change (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "初期値: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "初期値: 偽"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2216,36 +2196,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "ipa_automount_location (string)"
 msgid "pam_cert_verification (string)"
 msgstr "ipa_automount_location (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2255,7 +2235,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, fuzzy, no-wrap
 #| msgid ""
 #| "fallback_homedir = /home/%u\n"
@@ -2268,63 +2248,63 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "pam_id_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "simple_allow_users (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "simple_allow_users (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2332,7 +2312,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2344,63 +2324,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2408,12 +2388,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2424,7 +2404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2432,7 +2412,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2440,7 +2420,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2449,47 +2429,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2498,17 +2478,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 #, fuzzy
 #| msgid "Comma separated list of users who are allowed to log in."
 msgid ""
@@ -2517,13 +2497,13 @@ msgid ""
 msgstr "ログインが許可されたユーザーのカンマ区切り一覧です。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2531,7 +2511,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, fuzzy, no-wrap
 #| msgid ""
 #| "fallback_homedir = /home/%u\n"
@@ -2544,22 +2524,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2567,19 +2547,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2587,7 +2567,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2602,7 +2582,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2610,45 +2590,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2656,7 +2636,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2664,19 +2644,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 #, fuzzy
 #| msgid "Default: not set (no substitution for unset home directories)"
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr "初期値: 設定なし (ホームディレクトリーの設定がない場合は代替なし)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "SUDO 設定オプション"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2687,12 +2667,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -2701,12 +2681,12 @@ msgstr ""
 "を評価するかしないかです。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2716,22 +2696,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "Autofs 設定オプション"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr "これらのオプションが autofs サービスを設定するために使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2742,51 +2722,51 @@ msgstr ""
 "ヒットする秒数を指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "SSH 設定オプション"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr "これらのオプションは SSH サービスを設定するために使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "初期値: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2795,12 +2775,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2810,7 +2790,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2818,7 +2798,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2827,38 +2807,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2869,7 +2849,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2880,24 +2860,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2905,19 +2885,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2926,7 +2906,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2935,26 +2915,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "ldap_schema (string)"
 msgid "pac_check (string)"
 msgstr "ldap_schema (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2965,24 +2945,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2990,24 +2970,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3019,7 +2999,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3030,41 +3010,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -3077,19 +3057,19 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3099,66 +3079,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3169,17 +3149,17 @@ msgstr ""
 "の可能性がある場合には、その後になります。"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3190,7 +3170,7 @@ msgstr ""
 "文字の変更などの可能性がある場合には、その後になります。"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3199,65 +3179,65 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "simple_deny_users (string)"
 msgid "exclude_users (string)"
 msgstr "simple_deny_users (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No users excluded."
 msgstr "初期値: 空、つまり ldap_uri が使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "simple_deny_groups (string)"
 msgid "exclude_groups (string)"
 msgstr "simple_deny_groups (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No groups excluded."
 msgstr "初期値: 空、つまり ldap_uri が使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "ドメインセクション"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3267,12 +3247,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3281,14 +3261,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3297,31 +3277,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3330,7 +3310,7 @@ msgstr ""
 "トリーを含む場合、それは無視されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3342,24 +3322,24 @@ msgstr ""
 "バーに対して、範囲内にあるものは予期されたものとして報告されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "初期値: min_id は 1, max_id は 0 (無制限)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3368,36 +3348,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = ユーザーとグループが列挙されます"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = このドメインに対して列挙しません"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "初期値: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3411,7 +3391,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3420,7 +3400,7 @@ msgstr ""
 "れが完了するまで結果を返しません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3433,14 +3413,14 @@ msgstr ""
 "てください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3448,32 +3428,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3482,12 +3462,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -3496,7 +3476,7 @@ msgstr ""
 "数です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3507,17 +3487,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "初期値: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -3526,19 +3506,19 @@ msgstr ""
 "考える秒数です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "初期値: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -3547,12 +3527,12 @@ msgstr ""
 "考える秒数です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -3561,12 +3541,12 @@ msgstr ""
 "有効であると考える秒数です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -3575,48 +3555,48 @@ msgstr ""
 "考える秒数です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -3625,31 +3605,31 @@ msgstr ""
 "秒キャッシュするか。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3658,17 +3638,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3680,18 +3660,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "初期値: 0 (無効)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3702,7 +3682,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3711,12 +3691,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3727,19 +3707,19 @@ msgstr ""
 "に保存する必要がある最小の長さを決定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3751,17 +3731,17 @@ msgstr ""
 "offline_credentials_expiration と同等以上でなければいけません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "初期値: 0 (無制限)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3770,17 +3750,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "初期値: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -3788,12 +3768,12 @@ msgstr ""
 "ダーは次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3801,7 +3781,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3812,8 +3792,8 @@ msgstr ""
 "manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 #, fuzzy
 #| msgid ""
 #| "<quote>ipa</quote>: FreeIPA and Red Hat Enterprise Identity Management "
@@ -3831,8 +3811,8 @@ msgstr ""
 "い。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3843,12 +3823,12 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -3857,7 +3837,7 @@ msgstr ""
 "名形式により整形されたように) を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3870,7 +3850,7 @@ msgstr ""
 "んが、<command>getent passwd test@LOCAL</command> は見つけられます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3878,24 +3858,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3907,7 +3887,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3915,23 +3895,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -3940,7 +3920,7 @@ msgstr ""
 "ダーは次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3951,7 +3931,7 @@ msgstr ""
 "manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3962,19 +3942,19 @@ msgstr ""
 "manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 "<quote>proxy</quote> はいくつかの他の PAM ターゲットに認証を中継します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> は明示的に認証を無効化します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -3983,12 +3963,12 @@ msgstr ""
 "ならば、それが使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3999,7 +3979,7 @@ msgstr ""
 "えます）。内部の特別プロバイダーは次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4008,12 +3988,12 @@ msgstr ""
 "ロバイダーのみアクセスが許可されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> は常にアクセスを拒否します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4026,7 +4006,7 @@ msgstr ""
 "citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4034,22 +4014,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "初期値: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4058,7 +4038,7 @@ msgstr ""
 "パスワード変更プロバイダーは次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4066,7 +4046,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4077,7 +4057,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
@@ -4085,12 +4065,12 @@ msgstr ""
 "します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> は明示的にパスワードの変更を無効化します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4099,19 +4079,19 @@ msgstr ""
 "うことができるならば、それが使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "ドメインに使用される SUDO プロバイダーです。サポートされる SUDO プロバイダー"
 "は次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4122,33 +4102,33 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry> を参照します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> は SUDO を明示的に無効化します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "初期値: <quote>id_provider</quote> の値が設定されていると使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4159,7 +4139,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4168,12 +4148,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4181,7 +4161,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4189,31 +4169,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4221,7 +4201,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4230,17 +4210,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "<quote>none</quote> はサブドメインの取り出しを明示的に無効化します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4248,30 +4228,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -4279,7 +4259,7 @@ msgstr ""
 "プロバイダーは次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4290,7 +4270,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4301,7 +4281,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4309,17 +4289,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> は明示的に autofs を無効にします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -4328,7 +4308,7 @@ msgstr ""
 "hostid プロバイダーは次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4339,31 +4319,31 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> を参照してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> は明示的に hostid を無効にします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4371,7 +4351,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4380,12 +4360,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4395,24 +4375,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "username@domain.name"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4421,19 +4401,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "domain\\username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4443,17 +4423,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "初期値: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -4462,93 +4442,98 @@ msgstr ""
 "します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "サポートする値:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: IPv4 アドレスの検索を試行します。失敗すると IPv6 を試行します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 "ipv4_only: ホスト名を IPv4 アドレスに名前解決することのみを試行します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: IPv6 アドレスの検索を試行します。失敗すると IPv4 を試行します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 "ipv6_only: ホスト名を IPv6 アドレスに名前解決することのみを試行します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "初期値: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "初期値: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "初期値: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4557,14 +4542,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4572,7 +4557,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4580,17 +4565,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "初期値: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -4599,19 +4584,19 @@ msgstr ""
 "イン部分を指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr "初期値: マシンのホスト名のドメイン部分を使用します"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "pam_id_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4619,59 +4604,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "初期値: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "プライマリー GID の値を指定されたもので上書きします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4679,14 +4664,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -4699,17 +4684,17 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4717,128 +4702,128 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_search_timeout (integer)"
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "ldap_network_timeout (integer)"
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "ldap_connection_expire_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 #, fuzzy
 #| msgid "ldap_purge_cache_timeout (integer)"
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 #, fuzzy
 #| msgid "ldap_krb5_ticket_lifetime (integer)"
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "ldap_enumeration_search_timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "ldap_connection_expire_timeout (integer)"
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_expire_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4846,27 +4831,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "サブドメインのフラット (NetBIOS) 名。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4876,35 +4861,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 "値は <emphasis>override_homedir</emphasis> オプションにより上書きできます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "初期値: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr "このドメインのための realmd 設定サービスによって格納された様々なタグ。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4913,19 +4898,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4933,14 +4918,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy (string)"
 msgstr "ldap_pwd_policy (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4952,7 +4937,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4964,7 +4949,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4972,44 +4957,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_pwd_policy (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5018,7 +5003,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5029,7 +5014,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5037,38 +5022,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: cn"
 msgid "Default: match"
 msgstr "初期値: cn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5077,24 +5062,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5104,14 +5089,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5119,21 +5104,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5141,7 +5126,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5150,7 +5135,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5159,7 +5144,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -5170,17 +5155,17 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "中継するプロキシターゲット PAM です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 #, fuzzy
 #| msgid ""
 #| "Default: not set by default, you have to take an existing pam "
@@ -5194,12 +5179,12 @@ msgstr ""
 "をここに追加する必要があります。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -5210,12 +5195,12 @@ msgstr ""
 "_nss_files_getpwent です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -5223,12 +5208,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -5237,12 +5222,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -5250,7 +5235,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -5259,12 +5244,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5281,7 +5266,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5289,17 +5274,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5308,7 +5293,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5318,7 +5303,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5338,12 +5323,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5354,69 +5339,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5429,7 +5414,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5437,7 +5422,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5446,55 +5431,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5503,17 +5488,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5521,26 +5506,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5549,17 +5534,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5569,7 +5554,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5578,59 +5563,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5639,7 +5624,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5647,18 +5632,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5666,39 +5662,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 #, fuzzy
 #| msgid ""
 #| "The following expansions are supported: <placeholder "
@@ -5711,7 +5707,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5720,7 +5716,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5728,12 +5724,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[sssd]\n"
@@ -5811,7 +5807,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5820,7 +5816,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5828,7 +5824,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5839,7 +5835,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5850,7 +5846,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -6040,7 +6036,7 @@ msgstr ""
 "な LDAP 検索フィルターである必要があります。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "例:"
@@ -6478,7 +6474,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "初期値: 900 (15 分)"
 
@@ -6759,7 +6755,7 @@ msgstr ""
 "書を含むファイルを指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6774,11 +6770,19 @@ msgstr "ldap_tls_cacertdir (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "個別のファイルに CA 証明書を含むディレクトリーのパスを指定します。一般的に"
 "ファイル名は '.0' で終わる証明書のハッシュである必要があります。利用可能なら"
@@ -6786,32 +6790,32 @@ msgstr ""
 "ます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr "クライアントのキーに対する証明書を含むファイルを指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "クライアントのキーを含むファイルを指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6819,12 +6823,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 #, fuzzy
 #| msgid ""
 #| "Specifies that the id_provider connection must also use <systemitem "
@@ -6838,12 +6842,12 @@ msgstr ""
 "用する必要がある id_provider 接続を指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6851,18 +6855,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "この機能は現在 ActiveDirectory objectSID マッピングのみサポートします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6873,24 +6877,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6901,12 +6905,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6919,7 +6923,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6931,17 +6935,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "初期値: host/hostname@REALM"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6949,17 +6953,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "初期値: krb5_realm の値"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -6968,33 +6972,33 @@ msgstr ""
 "するために逆引きを実行します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "初期値: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "初期値: システムのキーテーブル、通常 <filename>/etc/krb5.keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -7002,28 +7006,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "初期値: 86400 (24 時間)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -7035,7 +7039,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -7046,7 +7050,7 @@ msgstr ""
 "ば _tcp にフォールバックします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -7057,27 +7061,27 @@ msgstr ""
 "quote> を使用するよう設定ファイルを移行することが推奨されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr "初期値: システムの初期値、<filename>/etc/krb5.conf</filename> 参照。"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -7086,12 +7090,12 @@ msgstr ""
 "します。この機能は MIT Kerberos >= 1.7 で利用可能です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -7101,7 +7105,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -7112,12 +7116,12 @@ msgstr ""
 "manvolnum> </citerefentry> マニュアルページを参照ください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -7126,7 +7130,7 @@ msgstr ""
 "す。以下の値が許容されます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -7135,7 +7139,7 @@ msgstr ""
 "ンはサーバー側のパスワードポリシーを無効にできません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 #, fuzzy
 #| msgid ""
 #| "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
@@ -7152,7 +7156,7 @@ msgstr ""
 "manvolnum></citerefentry> 形式の属性を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -7163,24 +7167,24 @@ msgstr ""
 "とき、これらの属性を更新するために chpass_provider=krb5 を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr "自動参照追跡が有効化されるかを指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -7189,7 +7193,7 @@ msgstr ""
 "sssd のみが参照追跡をサポートすることに注意してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -7202,28 +7206,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "サービス検索が有効にされているときに使用するサービスの名前を指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "初期値: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -7232,24 +7236,24 @@ msgstr ""
 "を検索するために使用するサービスの名前を指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr "初期値: 設定されていません、つまりサービス検索が無効にされています"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -7258,12 +7262,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -7279,12 +7283,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "例:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7293,14 +7297,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -7309,17 +7313,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "初期値: 空白"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -7328,7 +7332,7 @@ msgstr ""
 "ます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -7339,12 +7343,12 @@ msgstr ""
 "否します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "以下の値が許可されます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -7353,7 +7357,7 @@ msgstr ""
 "ldap_user_shadow_expire の値を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -7362,7 +7366,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -7373,7 +7377,7 @@ msgstr ""
 "ldap_ns_account_lock の値を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -7386,7 +7390,7 @@ msgstr ""
 "クセスが許可されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -7394,23 +7398,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "アクセス制御オプションのカンマ区切り一覧です。許可される値は次のとおりです:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis>: ldap_access_filter を使用します"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7420,14 +7424,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7440,12 +7444,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>expire</emphasis>: ldap_account_expire_policy を使用します"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -7455,38 +7459,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -7495,44 +7500,44 @@ msgstr ""
 "authorizedService 属性を使用します"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis>: アクセス権を決めるために host 属性を使用します"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "初期値: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr "値が複数使用されていると設定エラーになることに注意してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7541,22 +7546,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -7565,12 +7570,12 @@ msgstr ""
 "ションが許容されます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr "<emphasis>never</emphasis>: エイリアスが参照解決されません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -7579,7 +7584,7 @@ msgstr ""
 "決されますが、検索のベースオブジェクトの位置を探すときはされません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -7588,7 +7593,7 @@ msgstr ""
 "すときのみ参照解決されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -7597,7 +7602,7 @@ msgstr ""
 "きも位置を検索するときも参照解決されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -7606,12 +7611,12 @@ msgstr ""
 "して取り扱われます）"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -7620,7 +7625,7 @@ msgstr ""
 "ユーザーを保持することができます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7631,7 +7636,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7639,70 +7644,88 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "debug_level (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "debug_level (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 #, fuzzy
 #| msgid "Default: 0 (disabled)"
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "初期値: 0 (無効)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "ldap_id_mapping (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_id_mapping (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (整数)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7716,12 +7739,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "SUDO オプション"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7729,19 +7752,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -7750,24 +7773,24 @@ msgstr ""
 "ります"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "初期値: 21600 (6 時間)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7775,14 +7798,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7792,21 +7815,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_idmap_range_size (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_idmap_range_size (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7814,7 +7837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7822,29 +7845,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -7853,15 +7876,15 @@ msgstr ""
 "区切り一覧です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -7870,17 +7893,17 @@ msgstr ""
 "ならば、このオプションは効果を持ちません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "初期値: 指定なし"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -7889,7 +7912,7 @@ msgstr ""
 "アドレスの空白区切り一覧です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -7897,38 +7920,38 @@ msgstr ""
 "このオプションが空白ならば、SSSD は自動的にアドレスを検索しようとします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7940,59 +7963,59 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry> を参照してください"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "AUTOFS オプション"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "LDAP のオートマウントマスターマップの名前。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "高度なオプション"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -8001,22 +8024,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -8025,14 +8048,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "例"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -8043,7 +8066,7 @@ msgstr ""
 "す。"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8056,27 +8079,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -8092,13 +8115,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "注記"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -10429,7 +10452,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (論理値)"
 
@@ -10444,7 +10467,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -10462,12 +10485,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -10488,12 +10511,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "初期値: 1200 (秒)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -10517,17 +10540,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -10535,19 +10558,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 #, fuzzy
 #| msgid "dyndns_iface (string)"
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_iface (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -10555,7 +10578,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -10582,7 +10605,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (整数)"
 
@@ -10595,12 +10618,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -10614,7 +10637,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -10626,12 +10649,12 @@ msgid "Default: False (disabled)"
 msgstr "初期値: False (無効)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -10640,48 +10663,48 @@ msgstr ""
 "どうか。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10852,26 +10875,26 @@ msgstr ""
 "めに使用するベース DN に変換されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10890,7 +10913,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "初期値: 5 (秒)"
 
@@ -11617,14 +11640,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -11633,7 +11658,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -11642,14 +11667,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -11662,7 +11687,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -11671,7 +11696,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -11689,24 +11714,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11715,7 +11740,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11724,12 +11749,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11739,7 +11764,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11748,7 +11773,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11757,7 +11782,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11767,21 +11792,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11791,7 +11816,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11806,23 +11831,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11830,22 +11855,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11856,7 +11881,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11864,80 +11889,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "all users are allowed"
 msgstr "以下の値が許可されます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "only users in allow-rules are allowed"
 msgstr "以下の値が許可されます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "no users are allowed"
 msgstr "以下の値が許可されます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11947,12 +11972,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11960,12 +11985,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11981,14 +12006,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11996,7 +12021,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12008,42 +12033,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -12059,7 +12084,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -12067,7 +12092,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -12075,7 +12100,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12087,22 +12112,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -12118,7 +12143,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -12126,7 +12151,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -12134,7 +12159,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12146,22 +12171,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -12176,14 +12201,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -12191,7 +12216,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12203,23 +12228,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -12235,14 +12260,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -12250,7 +12275,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -12261,19 +12286,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -12281,7 +12306,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -12293,29 +12318,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -12323,12 +12348,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -12341,52 +12366,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -12394,17 +12419,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -12414,17 +12439,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -12433,12 +12458,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -12449,14 +12474,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 #, fuzzy
 #| msgid "ldap_sudo_include_netgroups (boolean)"
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ldap_sudo_include_netgroups (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -12467,7 +12492,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -12482,7 +12507,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -12494,7 +12519,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -12505,19 +12530,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "初期値: 3600 (秒)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -12527,7 +12552,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -12538,7 +12563,7 @@ msgstr ""
 "AD プロバイダー固有のオプションのみ示してします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -12562,7 +12587,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -12574,7 +12599,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -12582,7 +12607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -12592,7 +12617,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -13118,76 +13143,89 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr "終了コード"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 #, fuzzy
 #| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
 msgstr "NSS 設定オプション"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -15150,7 +15188,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -15187,8 +15225,59 @@ msgstr ""
 "SSSD ドメイン <replaceable>DOMAIN</replaceable> においてホスト公開鍵を検索し"
 "ます。"
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-R</option>,<option>--no-remove</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-R</option>,<option>--no-remove</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -19007,14 +19096,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -19594,6 +19682,16 @@ msgstr ""
 "ホストとユーザーのプリンシパルが正規化されるかどうかを指定します。この機能は "
 "MIT Kerberos 1.7 およびそれ以降で利用可能です。"
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (整数)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "データプロバイダーがクラッシュまたは再起動した場合、サービスが再接続をあき"
+#~ "らめる前に試行する回数です。"
+
 #, fuzzy
 #~| msgid "This option is not available in IPA provider."
 #~ msgid "This option is ignored for the files provider."
@@ -20003,9 +20101,6 @@ msgstr ""
 #~ "ユーザーのホームディレクトリーにあるファイルは、それ自身のホームディレクト"
 #~ "リーとユーザーのメールスプールとともに削除されます。設定が上書きされます。"
 
-#~ msgid "<option>-R</option>,<option>--no-remove</option>"
-#~ msgstr "<option>-R</option>,<option>--no-remove</option>"
-
 #~ msgid ""
 #~ "Files in the user's home directory will NOT be removed along with the "
 #~ "home directory itself and the user's mail spool. Overrides the "
diff --git a/src/man/po/lv.po b/src/man/po/lv.po
index 8222dce012e..9be270a9b7b 100644
--- a/src/man/po/lv.po
+++ b/src/man/po/lv.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2014-12-15 12:00-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Latvian (http://www.transifex.com/projects/p/sssd/language/"
@@ -212,13 +212,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr ""
 
@@ -235,11 +235,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -272,8 +272,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -303,8 +303,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Noklusējuma: 10"
 
@@ -340,46 +340,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr ""
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domēni"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -390,19 +371,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -410,12 +391,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -423,70 +404,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -494,7 +475,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -502,52 +483,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -555,14 +536,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -572,17 +553,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -592,7 +573,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -605,8 +586,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -614,12 +595,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -629,7 +610,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -638,22 +619,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -661,12 +642,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -674,61 +655,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -736,12 +717,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -749,24 +730,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -775,12 +756,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -789,7 +770,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -797,58 +778,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -859,7 +840,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -877,18 +858,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -896,12 +877,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -909,24 +890,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -934,7 +915,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -953,12 +934,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -967,22 +948,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -992,17 +973,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1012,19 +993,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 60, KCM: 300"
 msgstr "Noklusējuma: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1035,14 +1016,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1050,46 +1031,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Noklusējuma: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1098,64 +1079,64 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "Noklusējuma: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "Noklusējuma: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1167,58 +1148,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Noklusējuma: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1226,7 +1207,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1236,7 +1217,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1245,17 +1226,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1263,17 +1244,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Noklusējuma: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1281,17 +1262,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1300,7 +1281,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1309,41 +1290,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1351,23 +1332,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1375,47 +1356,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1423,115 +1404,115 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1539,27 +1520,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1567,19 +1548,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Noklusējuma: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1587,14 +1568,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1603,12 +1584,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1619,45 +1600,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>permit</quote>"
 msgid "Default: <quote>*</quote>"
 msgstr "Noklusējuma: <quote>atļaut</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1666,60 +1647,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Noklusējuma: 0 (bez ierobežojuma)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1727,59 +1708,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Noklusējuma: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1788,51 +1769,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1843,23 +1824,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1867,7 +1848,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1876,17 +1857,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1894,31 +1875,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1928,75 +1910,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2004,19 +1986,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2024,46 +2006,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2071,34 +2053,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2108,7 +2090,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2116,61 +2098,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2178,7 +2160,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2190,63 +2172,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2254,12 +2236,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2270,7 +2252,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2278,7 +2260,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2286,7 +2268,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2295,47 +2277,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2344,30 +2326,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2375,7 +2357,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2383,22 +2365,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2406,19 +2388,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2426,7 +2408,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2441,7 +2423,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2449,45 +2431,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2495,7 +2477,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2503,17 +2485,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2524,24 +2506,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2551,22 +2533,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2574,51 +2556,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2627,12 +2609,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2642,7 +2624,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2650,7 +2632,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2659,38 +2641,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2701,7 +2683,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2712,24 +2694,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2737,19 +2719,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2758,7 +2740,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2767,24 +2749,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2795,24 +2777,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2820,24 +2802,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2849,7 +2831,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2860,60 +2842,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2923,66 +2905,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2990,17 +2972,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3008,7 +2990,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3017,57 +2999,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3077,12 +3059,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3091,14 +3073,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3107,38 +3089,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3147,24 +3129,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3173,36 +3155,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3216,14 +3198,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3232,14 +3214,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3247,32 +3229,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3281,19 +3263,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3304,139 +3286,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3445,17 +3427,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3467,18 +3449,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3489,7 +3471,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3498,12 +3480,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3511,19 +3493,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3532,17 +3514,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Noklusējuma: 0 (neierobežots)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3551,28 +3533,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3580,7 +3562,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3588,8 +3570,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3597,8 +3579,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3606,19 +3588,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3627,7 +3609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3635,24 +3617,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3664,7 +3646,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3672,30 +3654,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3703,7 +3685,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3711,30 +3693,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3742,19 +3724,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3763,7 +3745,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3771,29 +3753,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Noklusējuma: <quote>atļaut</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3801,7 +3783,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3809,35 +3791,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3845,32 +3827,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3881,7 +3863,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3890,12 +3872,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3903,7 +3885,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3911,31 +3893,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3943,7 +3925,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3952,17 +3934,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3970,36 +3952,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4007,7 +3989,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4015,7 +3997,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4023,24 +4005,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4048,31 +4030,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4080,7 +4062,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4089,12 +4071,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4104,24 +4086,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4130,19 +4112,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4152,106 +4134,111 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Noklusējuma: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Atbalstītās vērtības:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4260,14 +4247,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4275,7 +4262,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4283,38 +4270,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 #, fuzzy
 #| msgid "Default: 6"
 msgid "Default: TRUE"
 msgstr "Noklusējuma: 6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4322,59 +4309,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 1"
 msgid "Default: 31"
 msgstr "Noklusējuma: 1"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4382,31 +4369,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4414,114 +4401,114 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "noildze (vesels skaitlis)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4529,27 +4516,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4559,34 +4546,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4595,19 +4582,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4615,12 +4602,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4632,7 +4619,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4644,7 +4631,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4652,42 +4639,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4696,7 +4683,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4707,7 +4694,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4715,38 +4702,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: 6"
 msgid "Default: match"
 msgstr "Noklusējuma: 6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4755,24 +4742,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4782,14 +4769,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4797,21 +4784,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4819,7 +4806,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4828,7 +4815,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4837,7 +4824,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4845,17 +4832,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4863,12 +4850,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4876,12 +4863,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4889,12 +4876,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4903,12 +4890,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4916,19 +4903,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4945,7 +4932,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4953,17 +4940,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4972,7 +4959,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4982,7 +4969,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5002,12 +4989,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5018,69 +5005,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5093,7 +5080,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5101,7 +5088,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5110,55 +5097,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5167,17 +5154,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5185,26 +5172,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5213,17 +5200,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5233,7 +5220,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5242,59 +5229,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5303,7 +5290,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5311,18 +5298,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5330,46 +5328,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5378,7 +5376,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5386,12 +5384,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5420,7 +5418,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5429,7 +5427,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5437,7 +5435,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5448,7 +5446,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5459,7 +5457,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5621,7 +5619,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -6033,7 +6031,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6288,7 +6286,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6305,36 +6303,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6342,12 +6341,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6355,12 +6354,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6368,17 +6367,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6389,24 +6388,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6417,12 +6416,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6435,7 +6434,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6447,17 +6446,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6465,49 +6464,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6515,28 +6514,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Noklusējuma: 86400 (24 stundas)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6548,7 +6547,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6556,7 +6555,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6564,39 +6563,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6606,7 +6605,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6614,26 +6613,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6642,7 +6641,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6650,31 +6649,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6687,51 +6686,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Noklusējuma: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6740,12 +6739,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6761,12 +6760,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Piemērs:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6775,14 +6774,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6791,24 +6790,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6816,19 +6815,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Atļautas šādas vērtības:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6837,7 +6836,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6845,7 +6844,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6854,7 +6853,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6862,22 +6861,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6887,14 +6886,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6907,12 +6906,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6922,81 +6921,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Noklusējuma: filtrēt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7005,74 +7005,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7083,7 +7083,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7091,64 +7091,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7162,12 +7178,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7175,43 +7191,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7219,14 +7235,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7236,19 +7252,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7256,7 +7272,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7264,106 +7280,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7372,59 +7388,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "PAPLAŠINĀTĀS IESPĒJAS"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7433,22 +7449,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7457,14 +7473,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "PIEMĒRS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7472,7 +7488,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7485,27 +7501,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7521,13 +7537,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "PIEZĪMES"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9768,7 +9784,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9783,7 +9799,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9798,12 +9814,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9824,12 +9840,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9853,17 +9869,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9871,17 +9887,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9889,7 +9905,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9916,7 +9932,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9929,12 +9945,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9948,7 +9964,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9960,60 +9976,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10161,26 +10177,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10199,7 +10215,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10914,14 +10930,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10930,7 +10948,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10939,14 +10957,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10959,7 +10977,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10968,7 +10986,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10986,24 +11004,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11012,7 +11030,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11021,12 +11039,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11036,7 +11054,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11045,7 +11063,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11054,7 +11072,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11064,21 +11082,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11088,7 +11106,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11103,23 +11121,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11127,22 +11145,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11153,7 +11171,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11161,80 +11179,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "all users are allowed"
 msgstr "Atļautas šādas vērtības:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "only users in allow-rules are allowed"
 msgstr "Atļautas šādas vērtības:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 #, fuzzy
 #| msgid "The following values are allowed:"
 msgid "no users are allowed"
 msgstr "Atļautas šādas vērtības:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11244,12 +11262,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11257,12 +11275,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11278,14 +11296,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11293,7 +11311,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11305,42 +11323,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11356,7 +11374,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11364,7 +11382,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11372,7 +11390,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11384,22 +11402,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11415,7 +11433,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11423,7 +11441,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11431,7 +11449,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11443,22 +11461,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11473,14 +11491,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11488,7 +11506,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11500,23 +11518,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11532,14 +11550,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11547,7 +11565,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11558,19 +11576,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11578,7 +11596,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11590,29 +11608,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11620,12 +11638,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11638,52 +11656,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11691,17 +11709,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11711,17 +11729,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11730,12 +11748,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11746,12 +11764,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11762,7 +11780,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11777,7 +11795,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11789,7 +11807,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11800,19 +11818,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11822,7 +11840,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11830,7 +11848,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11845,7 +11863,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11854,7 +11872,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11862,7 +11880,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11872,7 +11890,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12355,74 +12373,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14217,7 +14248,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14238,8 +14269,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17910,14 +17990,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/nl.po b/src/man/po/nl.po
index cff7704c2fe..9f888ecb79f 100644
--- a/src/man/po/nl.po
+++ b/src/man/po/nl.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2014-12-15 12:02-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Dutch (http://www.transifex.com/projects/p/sssd/language/"
@@ -231,13 +231,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Standaard: true"
 
@@ -254,11 +254,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -293,8 +293,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -324,8 +324,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -361,48 +361,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (numeriek)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Aantal keer dat de service moet proberen om opnieuw te verbinden indien een "
-"Data Aanbieder crashed of opnieuw start voordat dit opgegeven wordt"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Standaard: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domeinen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -413,19 +392,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -433,12 +412,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -446,70 +425,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -517,7 +496,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -528,7 +507,7 @@ msgstr ""
 "gezet worden"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -537,7 +516,7 @@ msgstr ""
 "systemen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -547,12 +526,12 @@ msgstr ""
 "conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -561,26 +540,26 @@ msgstr ""
 "opslaan."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -588,14 +567,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -605,17 +584,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -625,7 +604,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -638,8 +617,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -647,12 +626,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -662,7 +641,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -671,22 +650,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -694,12 +673,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -707,61 +686,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -769,12 +748,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -782,24 +761,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -808,12 +787,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -822,7 +801,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -830,58 +809,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -892,7 +871,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -910,18 +889,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -929,12 +908,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -942,28 +921,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "passkey_verification (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "user_verification (boolean)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -971,7 +950,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -990,12 +969,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "SERVICES SECTIE"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1004,22 +983,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Algemene service configuratie-opties"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Deze opties kunnen gebruikt worden om services te configureren."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1029,17 +1008,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1049,19 +1028,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 60, KCM: 300"
 msgstr "Standaard: 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1072,14 +1051,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1087,46 +1066,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1135,62 +1114,62 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 3600"
 msgstr "Standaard: 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 30"
 msgstr "Standaard: 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1202,30 +1181,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "NSS configuratie-opties"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1233,12 +1212,12 @@ msgstr ""
 "configurere."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1247,17 +1226,17 @@ msgstr ""
 "over alle gebruikers)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Standaard: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1265,7 +1244,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1275,7 +1254,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1284,17 +1263,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1302,17 +1281,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1320,17 +1299,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1339,7 +1318,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1348,41 +1327,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1390,23 +1369,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1414,47 +1393,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1462,117 +1441,117 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1580,27 +1559,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1608,21 +1587,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1630,14 +1609,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1646,12 +1625,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1662,45 +1641,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>%1$s@%2$s</quote>."
 msgid "Default: <quote>*</quote>"
 msgstr "Standaard: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1709,60 +1688,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1770,61 +1749,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pam_response_filter (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1833,51 +1812,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1888,23 +1867,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1912,7 +1891,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1921,17 +1900,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1939,31 +1918,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Standaard: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1973,75 +1953,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2049,19 +2029,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2069,46 +2049,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2116,36 +2096,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pam_cert_verification (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2155,7 +2135,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2163,63 +2143,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2227,7 +2207,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2239,63 +2219,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2303,12 +2283,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2319,7 +2299,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2327,7 +2307,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2335,7 +2315,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2344,47 +2324,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2393,30 +2373,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2424,7 +2404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2432,22 +2412,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2455,19 +2435,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2475,7 +2455,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2490,7 +2470,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2498,45 +2478,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2544,7 +2524,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2552,17 +2532,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2573,24 +2553,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2600,22 +2580,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2623,51 +2603,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2676,12 +2656,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2691,7 +2671,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2699,7 +2679,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2708,38 +2688,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2750,7 +2730,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2761,24 +2741,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2786,19 +2766,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2807,7 +2787,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2816,26 +2796,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "pac_check (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2846,24 +2826,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2871,24 +2851,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2900,7 +2880,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2911,60 +2891,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2974,66 +2954,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3041,17 +3021,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3059,7 +3039,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3068,59 +3048,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "exclude_users (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3130,12 +3110,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3144,14 +3124,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3160,38 +3140,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3200,24 +3180,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3226,36 +3206,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3269,14 +3249,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3285,14 +3265,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3300,32 +3280,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3334,19 +3314,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3357,139 +3337,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3498,17 +3478,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3520,18 +3500,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3542,7 +3522,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3551,12 +3531,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3564,19 +3544,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3585,17 +3565,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3604,28 +3584,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3633,7 +3613,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3641,8 +3621,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3650,8 +3630,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3659,19 +3639,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3680,7 +3660,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3688,24 +3668,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3717,7 +3697,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3725,30 +3705,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3756,7 +3736,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3764,30 +3744,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3795,19 +3775,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3816,7 +3796,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3824,29 +3804,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3854,7 +3834,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3862,35 +3842,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3898,32 +3878,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3934,7 +3914,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3943,12 +3923,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3956,7 +3936,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3964,31 +3944,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3996,7 +3976,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4005,17 +3985,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4023,36 +4003,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4060,7 +4040,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4068,7 +4048,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4076,24 +4056,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4101,31 +4081,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4133,7 +4113,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4142,12 +4122,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4157,24 +4137,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4183,19 +4163,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4205,106 +4185,111 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Standaard: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "entry_negative_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "entry_negative_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "entry_negative_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "entry_negative_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Standaard: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4313,14 +4298,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "entry_negative_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "entry_negative_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4328,7 +4313,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4336,38 +4321,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: TRUE"
 msgstr "Standaard: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "entry_negative_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "entry_negative_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4375,59 +4360,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Standaard: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4435,31 +4420,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4467,114 +4452,114 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "enum_cache_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "enum_cache_timeout (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "reconnection_retries (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "reconnection_retries (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "reconnection_retries (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "reconnection_retries (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "reconnection_retries (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "reconnection_retries (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "reconnection_retries (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "reconnection_retries (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4582,27 +4567,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4612,34 +4597,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4648,19 +4633,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4668,14 +4653,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "local_auth_policy (string)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4687,7 +4672,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4699,7 +4684,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4707,44 +4692,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4753,7 +4738,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4764,7 +4749,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4772,38 +4757,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: match"
 msgstr "Standaard: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4812,24 +4797,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4839,14 +4824,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4854,21 +4839,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4876,7 +4861,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4885,7 +4870,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4894,7 +4879,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4902,17 +4887,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4920,12 +4905,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4933,12 +4918,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4946,12 +4931,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4960,12 +4945,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4973,19 +4958,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5002,7 +4987,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5010,17 +4995,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5029,7 +5014,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5039,7 +5024,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5059,12 +5044,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5075,69 +5060,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5150,7 +5135,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5158,7 +5143,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5167,55 +5152,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5224,17 +5209,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5242,26 +5227,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5270,17 +5255,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5290,7 +5275,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5299,59 +5284,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5360,7 +5345,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5368,18 +5353,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5387,46 +5383,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5435,7 +5431,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5443,12 +5439,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5477,7 +5473,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5486,7 +5482,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5494,7 +5490,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5505,7 +5501,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5516,7 +5512,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5678,7 +5674,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -6090,7 +6086,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6345,7 +6341,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6362,36 +6358,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6399,12 +6396,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6412,12 +6409,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6425,17 +6422,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6446,24 +6443,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6474,12 +6471,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6492,7 +6489,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6504,17 +6501,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6522,49 +6519,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6572,28 +6569,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6605,7 +6602,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6613,7 +6610,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6621,39 +6618,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6663,7 +6660,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6671,26 +6668,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6699,7 +6696,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6707,31 +6704,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6744,51 +6741,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6797,12 +6794,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6818,12 +6815,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6832,14 +6829,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6848,24 +6845,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6873,19 +6870,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6894,7 +6891,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6902,7 +6899,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6911,7 +6908,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6919,22 +6916,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6944,14 +6941,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6964,12 +6961,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6979,81 +6976,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7062,74 +7060,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7140,7 +7138,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7148,68 +7146,86 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "debug_level (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "debug_level (numeriek)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "re_expression (string)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "re_expression (tekst)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "debug_level (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "debug_level (numeriek)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7223,12 +7239,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7236,43 +7252,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7280,14 +7296,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7297,19 +7313,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7317,7 +7333,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7325,106 +7341,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7433,59 +7449,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7494,22 +7510,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7518,14 +7534,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7533,7 +7549,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7546,27 +7562,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7582,13 +7598,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9835,7 +9851,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9850,7 +9866,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9865,12 +9881,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9891,12 +9907,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9920,17 +9936,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9938,17 +9954,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9956,7 +9972,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9983,7 +9999,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9996,12 +10012,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -10015,7 +10031,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -10027,60 +10043,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10230,26 +10246,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10268,7 +10284,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10983,14 +10999,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10999,7 +11017,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -11008,14 +11026,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -11028,7 +11046,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -11037,7 +11055,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -11055,24 +11073,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11081,7 +11099,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11090,12 +11108,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11105,7 +11123,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11114,7 +11132,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11123,7 +11141,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11133,21 +11151,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11157,7 +11175,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11172,23 +11190,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11196,22 +11214,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11222,7 +11240,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11230,74 +11248,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11307,12 +11325,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11320,12 +11338,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11341,14 +11359,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11356,7 +11374,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11368,42 +11386,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11419,7 +11437,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11427,7 +11445,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11435,7 +11453,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11447,22 +11465,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11478,7 +11496,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11486,7 +11504,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11494,7 +11512,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11506,22 +11524,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11536,14 +11554,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11551,7 +11569,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11563,23 +11581,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11595,14 +11613,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11610,7 +11628,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11621,19 +11639,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11641,7 +11659,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11653,29 +11671,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11683,12 +11701,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11701,52 +11719,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11754,17 +11772,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11774,17 +11792,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11793,12 +11811,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11809,12 +11827,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11825,7 +11843,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11840,7 +11858,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11852,7 +11870,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11863,19 +11881,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11885,7 +11903,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11893,7 +11911,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11908,7 +11926,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11917,7 +11935,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11925,7 +11943,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11935,7 +11953,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12418,76 +12436,89 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 #, fuzzy
 #| msgid "NSS configuration options"
 msgid "Bad configuration or command line option."
 msgstr "NSS configuratie-opties"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14290,7 +14321,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14311,8 +14342,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17985,14 +18065,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -18545,6 +18624,16 @@ msgid ""
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (numeriek)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Aantal keer dat de service moet proberen om opnieuw te verbinden indien "
+#~ "een Data Aanbieder crashed of opnieuw start voordat dit opgegeven wordt"
+
 #~ msgid "config_file_version (integer)"
 #~ msgstr "config_file_version (numeriek)"
 
diff --git a/src/man/po/pt.po b/src/man/po/pt.po
index 32cfe7ec535..c5c47a06ade 100644
--- a/src/man/po/pt.po
+++ b/src/man/po/pt.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2014-12-15 12:05-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Portuguese (http://www.transifex.com/projects/p/sssd/language/"
@@ -226,13 +226,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr ""
 
@@ -249,11 +249,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Padrão: false"
@@ -288,8 +288,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -319,8 +319,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Padrão: 10"
 
@@ -356,48 +356,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (integer)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Número de vezes que os serviços devem tentar reconectar-se no caso de uma "
-"falha do provedor de dados ou reiniciar antes de eles desistirem"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Padrão: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domínios"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -408,19 +387,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -428,12 +407,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -441,70 +420,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -512,7 +491,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -520,52 +499,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -573,14 +552,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -590,17 +569,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -610,7 +589,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -623,8 +602,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -632,12 +611,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -647,7 +626,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -656,22 +635,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -679,12 +658,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -692,61 +671,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -754,12 +733,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -767,24 +746,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -793,12 +772,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -807,7 +786,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -815,58 +794,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -877,7 +856,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -895,20 +874,20 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 #, fuzzy
 #| msgid "ldap_krb5_init_creds (boolean)"
 msgid "implicit_pac_responder (boolean)"
 msgstr "ldap_krb5_init_creds (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -916,14 +895,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 #, fuzzy
 #| msgid "krb5_validate (boolean)"
 msgid "core_dumpable (boolean)"
 msgstr "krb5_validate (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -931,28 +910,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 #, fuzzy
 #| msgid "ldap_user_principal (string)"
 msgid "passkey_verification (string)"
 msgstr "ldap_user_principal (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 #, fuzzy
 #| msgid "ldap_user_principal (string)"
 msgid "user_verification (boolean)"
 msgstr "ldap_user_principal (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -960,7 +939,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -979,12 +958,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -993,22 +972,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1018,17 +997,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1038,19 +1017,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 60, KCM: 300"
 msgstr "Padrão: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1061,14 +1040,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1076,46 +1055,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Padrão: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 #, fuzzy
 #| msgid "timeout (integer)"
 msgid "offline_timeout_max (integer)"
 msgstr "timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1124,64 +1103,64 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 3600"
 msgstr "Padrão: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "offline_timeout_random_offset (integer)"
 msgstr "dns_resolver_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 300"
 msgid "Default: 30"
 msgstr "Padrão: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1193,58 +1172,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Padrão: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1252,7 +1231,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1262,7 +1241,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1271,17 +1250,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Padrão: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1289,17 +1268,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1307,17 +1286,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1326,7 +1305,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1335,41 +1314,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1377,23 +1356,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1401,47 +1380,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1449,117 +1428,117 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Padrão: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 #, fuzzy
 #| msgid "entry_cache_timeout (integer)"
 msgid "memcache_timeout (integer)"
 msgstr "entry_cache_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 #, fuzzy
 #| msgid "entry_cache_timeout (integer)"
 msgid "memcache_size_passwd (integer)"
 msgstr "entry_cache_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1567,27 +1546,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 #, fuzzy
 #| msgid "entry_cache_timeout (integer)"
 msgid "memcache_size_group (integer)"
 msgstr "entry_cache_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1595,21 +1574,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Padrão: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 #, fuzzy
 #| msgid "entry_cache_timeout (integer)"
 msgid "memcache_size_initgroups (integer)"
 msgstr "entry_cache_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1617,14 +1596,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 #, fuzzy
 #| msgid "entry_cache_timeout (integer)"
 msgid "memcache_size_sid (integer)"
 msgstr "entry_cache_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1633,12 +1612,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1649,45 +1628,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: <quote>%1$s@%2$s</quote>."
 msgid "Default: <quote>*</quote>"
 msgstr "Default: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1696,60 +1675,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1757,61 +1736,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Padrão: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 #, fuzzy
 #| msgid "access_provider (string)"
 msgid "pam_response_filter (string)"
 msgstr "access_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1820,51 +1799,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1875,23 +1854,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1899,7 +1878,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1908,17 +1887,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1926,31 +1905,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1960,75 +1940,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Padrão: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2036,19 +2016,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2056,46 +2036,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Padrão: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2103,36 +2083,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 #, fuzzy
 #| msgid "ldap_user_principal (string)"
 msgid "pam_cert_verification (string)"
 msgstr "ldap_user_principal (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2142,7 +2122,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2150,63 +2130,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "passkey_child_timeout (integer)"
 msgstr "pam_id_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 #, fuzzy
 #| msgid "allowed_shells (string)"
 msgid "pam_p11_allowed_services (string)"
 msgstr "allowed_shells (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2214,7 +2194,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2226,63 +2206,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2290,12 +2270,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2306,7 +2286,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2314,7 +2294,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2322,7 +2302,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2331,47 +2311,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2380,30 +2360,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2411,7 +2391,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2419,22 +2399,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2442,19 +2422,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2462,7 +2442,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2477,7 +2457,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2485,45 +2465,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2531,7 +2511,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2539,17 +2519,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2560,24 +2540,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2587,22 +2567,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2610,51 +2590,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2663,12 +2643,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2678,7 +2658,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2686,7 +2666,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2695,38 +2675,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2737,7 +2717,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2748,24 +2728,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2773,19 +2753,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2794,7 +2774,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2803,26 +2783,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 #, fuzzy
 #| msgid "ipa_hostname (string)"
 msgid "pac_check (string)"
 msgstr "ipa_hostname (string)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2833,24 +2813,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2858,24 +2838,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2887,7 +2867,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2898,60 +2878,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2961,66 +2941,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3028,17 +3008,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3046,7 +3026,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3055,65 +3035,65 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 #, fuzzy
 #| msgid "ldap_user_shell (string)"
 msgid "exclude_users (string)"
 msgstr "ldap_user_shell (string)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No users excluded."
 msgstr "Padrão: empty, ou seja, ldap_uri é usado."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 #, fuzzy
 #| msgid "ldap_group_search_base (string)"
 msgid "exclude_groups (string)"
 msgstr "ldap_group_search_base (string)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 #, fuzzy
 #| msgid "Default: empty, i.e. ldap_uri is used."
 msgid "Default: Empty. No groups excluded."
 msgstr "Padrão: empty, ou seja, ldap_uri é usado."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "SECÇÕES DE DOMÍNIO"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3123,12 +3103,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3137,14 +3117,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3153,38 +3133,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3193,24 +3173,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Padrão: 1 para min_id, 0 (sem limite) para max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3219,36 +3199,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Padrão: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3262,14 +3242,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3278,14 +3258,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3293,32 +3273,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3327,19 +3307,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3350,139 +3330,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Padrão: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3491,17 +3471,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3513,18 +3493,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3535,7 +3515,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3544,12 +3524,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3557,19 +3537,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3578,17 +3558,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Padrão: 0 (ilimitado)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3597,28 +3577,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3626,7 +3606,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3634,8 +3614,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3643,8 +3623,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3652,19 +3632,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3673,7 +3653,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3681,24 +3661,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3710,7 +3690,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3718,30 +3698,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3749,7 +3729,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3757,30 +3737,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3788,19 +3768,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3809,7 +3789,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3817,29 +3797,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3847,7 +3827,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3855,35 +3835,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3891,32 +3871,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3927,7 +3907,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3936,12 +3916,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3949,7 +3929,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3957,31 +3937,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3989,7 +3969,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3998,17 +3978,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4016,36 +3996,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4053,7 +4033,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4061,7 +4041,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4069,24 +4049,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4094,31 +4074,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4126,7 +4106,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4135,12 +4115,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4150,24 +4130,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4176,19 +4156,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4198,106 +4178,111 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Default: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Default: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Padrão: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Padrão: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4306,14 +4291,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 #, fuzzy
 #| msgid "dns_resolver_timeout (integer)"
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4321,7 +4306,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4329,36 +4314,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Padrão: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 #, fuzzy
 #| msgid "pam_id_timeout (integer)"
 msgid "failover_primary_timeout (integer)"
 msgstr "pam_id_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4366,59 +4351,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Padrão: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4426,31 +4411,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4458,126 +4443,126 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 #, fuzzy
 #| msgid "ldap_search_timeout (integer)"
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 #, fuzzy
 #| msgid "ldap_network_timeout (integer)"
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_offline_timeout"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 #, fuzzy
 #| msgid "ldap_krb5_ticket_lifetime (integer)"
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 #, fuzzy
 #| msgid "ldap_enumeration_refresh_timeout (integer)"
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_enumeration_refresh_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4585,27 +4570,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4615,34 +4600,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4651,19 +4636,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4671,14 +4656,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy (string)"
 msgstr "ldap_pwd_policy (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4690,7 +4675,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4702,7 +4687,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4710,44 +4695,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 #, fuzzy
 #| msgid "ldap_pwd_policy (string)"
 msgid "local_auth_policy = match (default)"
 msgstr "ldap_pwd_policy (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4756,7 +4741,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4767,7 +4752,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4775,38 +4760,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: cn"
 msgid "Default: match"
 msgstr "Padrão: NC"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4815,24 +4800,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4842,14 +4827,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4857,21 +4842,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4879,7 +4864,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4888,7 +4873,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4897,7 +4882,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4905,17 +4890,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4923,12 +4908,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4936,12 +4921,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4949,12 +4934,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4963,12 +4948,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4976,19 +4961,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -5005,7 +4990,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -5013,17 +4998,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -5032,7 +5017,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -5042,7 +5027,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5062,12 +5047,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -5078,69 +5063,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5153,7 +5138,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5161,7 +5146,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5170,55 +5155,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5227,17 +5212,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5245,26 +5230,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5273,17 +5258,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5293,7 +5278,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5302,59 +5287,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5363,7 +5348,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5371,18 +5356,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5390,46 +5386,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5438,7 +5434,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5446,12 +5442,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, fuzzy, no-wrap
 #| msgid ""
 #| "[sssd]\n"
@@ -5529,7 +5525,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5538,7 +5534,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5546,7 +5542,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5557,7 +5553,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5568,7 +5564,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5730,7 +5726,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Exemplos:"
@@ -6146,7 +6142,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6403,7 +6399,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6420,36 +6416,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6457,12 +6454,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6470,12 +6467,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6483,17 +6480,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6504,24 +6501,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6532,12 +6529,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6550,7 +6547,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6562,17 +6559,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6580,50 +6577,50 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Padrão: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Padrão: Sistema keytab, normalmente <filename>/etc/krb5.keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6631,28 +6628,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Padrão: 86400 (24 horas)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6664,7 +6661,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6672,7 +6669,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6680,39 +6677,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6722,7 +6719,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6730,26 +6727,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6758,7 +6755,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6766,31 +6763,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6803,51 +6800,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6856,12 +6853,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6877,12 +6874,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6891,14 +6888,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6907,24 +6904,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6932,19 +6929,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6953,7 +6950,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6961,7 +6958,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6970,7 +6967,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6978,22 +6975,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7003,14 +7000,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -7023,12 +7020,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -7038,81 +7035,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Padrão: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -7121,74 +7119,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7199,7 +7197,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7207,68 +7205,86 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 #, fuzzy
 #| msgid "ldap_page_size (integer)"
 msgid "ldap_library_debug_level (integer)"
 msgstr "ldap_page_size (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 #, fuzzy
 #| msgid "ldap_id_use_start_tls (boolean)"
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_id_use_start_tls (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_page_size (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_page_size (integer)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7282,12 +7298,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7295,43 +7311,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7339,14 +7355,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7356,21 +7372,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 #, fuzzy
 #| msgid "ldap_opt_timeout (integer)"
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_opt_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7378,7 +7394,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7386,106 +7402,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7494,59 +7510,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "OPÇÕES AVANÇADAS"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7555,22 +7571,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7579,14 +7595,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "EXEMPLO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7594,7 +7610,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7607,27 +7623,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7643,13 +7659,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTAS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9900,7 +9916,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9915,7 +9931,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9930,12 +9946,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9956,12 +9972,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9985,17 +10001,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -10003,19 +10019,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 #, fuzzy
 #| msgid "auth_provider (string)"
 msgid "dyndns_auth_ptr (string)"
 msgstr "auth_provider (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -10023,7 +10039,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -10050,7 +10066,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -10063,12 +10079,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -10082,7 +10098,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -10094,60 +10110,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10299,26 +10315,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10337,7 +10353,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -11052,14 +11068,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -11068,7 +11086,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -11077,14 +11095,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -11097,7 +11115,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -11106,7 +11124,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -11124,24 +11142,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -11150,7 +11168,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -11159,12 +11177,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11174,7 +11192,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11183,7 +11201,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11192,7 +11210,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11202,21 +11220,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11226,7 +11244,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11241,23 +11259,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11265,22 +11283,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11291,7 +11309,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11299,74 +11317,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11376,12 +11394,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11389,12 +11407,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11410,14 +11428,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11425,7 +11443,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11437,42 +11455,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11488,7 +11506,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11496,7 +11514,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11504,7 +11522,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11516,22 +11534,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11547,7 +11565,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11555,7 +11573,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11563,7 +11581,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11575,22 +11593,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11605,14 +11623,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11620,7 +11638,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11632,23 +11650,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11664,14 +11682,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11679,7 +11697,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11690,19 +11708,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11710,7 +11728,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11722,29 +11740,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11752,12 +11770,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11770,52 +11788,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11823,17 +11841,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11843,17 +11861,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11862,12 +11880,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11878,12 +11896,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11894,7 +11912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11909,7 +11927,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11921,7 +11939,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11932,19 +11950,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11954,7 +11972,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11962,7 +11980,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11977,7 +11995,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11986,7 +12004,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11994,7 +12012,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -12004,7 +12022,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12491,74 +12509,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14371,7 +14402,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14392,8 +14423,59 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-s</option>,<option>--stdin</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-s</option>,<option>--stdin</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -18074,14 +18156,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
@@ -18634,6 +18715,16 @@ msgid ""
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (integer)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Número de vezes que os serviços devem tentar reconectar-se no caso de uma "
+#~ "falha do provedor de dados ou reiniciar antes de eles desistirem"
+
 #~ msgid "config_file_version (integer)"
 #~ msgstr "config_file_version (integer)"
 
diff --git a/src/man/po/pt_BR.po b/src/man/po/pt_BR.po
index 3b6f60e5434..1bf219a83d3 100644
--- a/src/man/po/pt_BR.po
+++ b/src/man/po/pt_BR.po
@@ -4,7 +4,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2017-01-29 10:11-0500\n"
 "Last-Translator: Rodrigo de Araujo Sousa Fonseca "
 "<rodrigodearaujo@fedoraproject.org>\n"
@@ -206,13 +206,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr ""
 
@@ -229,11 +229,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -266,8 +266,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -297,8 +297,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -334,46 +334,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr ""
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -384,19 +365,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -404,12 +385,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -417,70 +398,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -488,7 +469,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -496,52 +477,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -549,14 +530,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -566,17 +547,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -586,7 +567,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -599,8 +580,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -608,12 +589,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -623,7 +604,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -632,22 +613,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -655,12 +636,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -668,61 +649,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -730,12 +711,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -743,24 +724,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -769,12 +750,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -783,7 +764,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -791,58 +772,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -853,7 +834,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -871,18 +852,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -890,12 +871,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -903,24 +884,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -928,7 +909,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -947,12 +928,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -961,22 +942,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -986,17 +967,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1006,17 +987,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1027,14 +1008,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1042,44 +1023,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1088,58 +1069,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1151,58 +1132,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1210,7 +1191,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1220,7 +1201,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1229,17 +1210,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1247,17 +1228,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1265,17 +1246,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1284,7 +1265,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1293,41 +1274,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1335,23 +1316,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1359,47 +1340,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1407,113 +1388,113 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1521,25 +1502,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1547,19 +1528,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1567,12 +1548,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1581,12 +1562,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1597,43 +1578,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1642,60 +1623,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1703,59 +1684,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1764,51 +1745,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1819,23 +1800,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1843,7 +1824,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1852,17 +1833,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1870,31 +1851,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1904,75 +1886,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1980,19 +1962,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2000,46 +1982,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2047,34 +2029,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2084,7 +2066,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2092,59 +2074,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2152,7 +2134,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2164,63 +2146,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2228,12 +2210,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2244,7 +2226,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2252,7 +2234,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2260,7 +2242,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2269,47 +2251,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2318,30 +2300,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2349,7 +2331,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2357,22 +2339,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2380,19 +2362,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2400,7 +2382,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2415,7 +2397,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2423,45 +2405,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2469,7 +2451,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2477,17 +2459,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2498,24 +2480,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2525,22 +2507,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2548,51 +2530,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2601,12 +2583,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2616,7 +2598,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2624,7 +2606,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2633,38 +2615,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2675,7 +2657,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2686,24 +2668,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2711,19 +2693,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2732,7 +2714,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2741,24 +2723,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2769,24 +2751,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2794,24 +2776,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2823,7 +2805,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2834,60 +2816,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2897,66 +2879,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2964,17 +2946,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -2982,7 +2964,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -2991,57 +2973,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3051,12 +3033,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3065,14 +3047,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3081,38 +3063,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3121,24 +3103,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3147,36 +3129,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3190,14 +3172,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3206,14 +3188,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3221,32 +3203,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3255,19 +3237,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3278,139 +3260,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3419,17 +3401,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3441,18 +3423,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3463,7 +3445,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3472,12 +3454,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3485,19 +3467,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3506,17 +3488,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3525,28 +3507,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3554,7 +3536,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3562,8 +3544,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3571,8 +3553,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3580,19 +3562,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3601,7 +3583,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3609,24 +3591,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3638,7 +3620,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3646,30 +3628,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3677,7 +3659,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3685,30 +3667,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3716,19 +3698,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3737,7 +3719,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3745,29 +3727,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3775,7 +3757,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3783,35 +3765,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3819,32 +3801,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3855,7 +3837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3864,12 +3846,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3877,7 +3859,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3885,31 +3867,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3917,7 +3899,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3926,17 +3908,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3944,36 +3926,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3981,7 +3963,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3989,7 +3971,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3997,24 +3979,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4022,31 +4004,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4054,7 +4036,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4063,12 +4045,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4078,24 +4060,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4104,19 +4086,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4126,102 +4108,107 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4230,12 +4217,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4243,7 +4230,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4251,34 +4238,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4286,57 +4273,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 msgid "Default: 31"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4344,31 +4331,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4376,104 +4363,104 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4481,27 +4468,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4511,34 +4498,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4547,19 +4534,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4567,12 +4554,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4584,7 +4571,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4596,7 +4583,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4604,42 +4591,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4648,7 +4635,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4659,7 +4646,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4667,36 +4654,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 msgid "Default: match"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4705,24 +4692,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4732,14 +4719,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4747,21 +4734,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4769,7 +4756,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4778,7 +4765,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4787,7 +4774,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4795,17 +4782,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4813,12 +4800,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4826,12 +4813,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4839,12 +4826,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4853,12 +4840,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4866,19 +4853,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4895,7 +4882,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4903,17 +4890,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4922,7 +4909,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4932,7 +4919,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -4952,12 +4939,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -4968,69 +4955,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5043,7 +5030,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5051,7 +5038,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5060,55 +5047,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5117,17 +5104,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5135,26 +5122,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5163,17 +5150,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5183,7 +5170,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5192,59 +5179,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5253,7 +5240,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5261,18 +5248,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5280,46 +5278,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5328,7 +5326,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5336,12 +5334,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5370,7 +5368,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5379,7 +5377,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5387,7 +5385,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5398,7 +5396,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5409,7 +5407,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5571,7 +5569,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -5983,7 +5981,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6236,7 +6234,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6253,36 +6251,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6290,12 +6289,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6303,12 +6302,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6316,17 +6315,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6337,24 +6336,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6365,12 +6364,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6383,7 +6382,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6395,17 +6394,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6413,49 +6412,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6463,28 +6462,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6496,7 +6495,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6504,7 +6503,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6512,39 +6511,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6554,7 +6553,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6562,26 +6561,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6590,7 +6589,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6598,31 +6597,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6635,51 +6634,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6688,12 +6687,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6709,12 +6708,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6723,14 +6722,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6739,24 +6738,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6764,19 +6763,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6785,7 +6784,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6793,7 +6792,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6802,7 +6801,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6810,22 +6809,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6835,14 +6834,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6855,12 +6854,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6870,81 +6869,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -6953,74 +6953,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7031,7 +7031,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7039,64 +7039,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7110,12 +7126,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7123,43 +7139,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7167,14 +7183,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7184,19 +7200,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7204,7 +7220,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7212,106 +7228,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7320,59 +7336,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7381,22 +7397,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7405,14 +7421,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7420,7 +7436,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7433,27 +7449,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7469,13 +7485,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9714,7 +9730,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9729,7 +9745,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9744,12 +9760,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9770,12 +9786,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9799,17 +9815,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9817,17 +9833,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9835,7 +9851,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9862,7 +9878,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9875,12 +9891,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9894,7 +9910,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9906,60 +9922,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10107,26 +10123,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10145,7 +10161,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10860,14 +10876,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10876,7 +10894,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10885,14 +10903,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10905,7 +10923,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10914,7 +10932,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10932,24 +10950,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -10958,7 +10976,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -10967,12 +10985,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -10982,7 +11000,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -10991,7 +11009,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11000,7 +11018,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11010,21 +11028,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11034,7 +11052,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11049,23 +11067,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11073,22 +11091,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11099,7 +11117,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11107,74 +11125,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11184,12 +11202,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11197,12 +11215,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11218,14 +11236,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11233,7 +11251,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11245,42 +11263,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11296,7 +11314,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11304,7 +11322,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11312,7 +11330,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11324,22 +11342,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11355,7 +11373,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11363,7 +11381,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11371,7 +11389,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11383,22 +11401,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11413,14 +11431,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11428,7 +11446,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11440,23 +11458,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11472,14 +11490,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11487,7 +11505,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11498,19 +11516,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11518,7 +11536,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11530,29 +11548,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11560,12 +11578,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11578,52 +11596,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11631,17 +11649,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11651,17 +11669,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11670,12 +11688,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11686,12 +11704,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11702,7 +11720,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11717,7 +11735,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11729,7 +11747,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11740,19 +11758,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11762,7 +11780,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11770,7 +11788,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11785,7 +11803,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11794,7 +11812,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11802,7 +11820,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11812,7 +11830,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12295,74 +12313,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14157,7 +14188,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14178,8 +14209,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17846,14 +17926,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/ru.po b/src/man/po/ru.po
index cd431550d3b..f94c9e15a03 100644
--- a/src/man/po/ru.po
+++ b/src/man/po/ru.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2024-09-24 08:39+0000\n"
 "Last-Translator: Elena Mishina <lepata@basealt.ru>\n"
 "Language-Team: Russian <https://translate.fedoraproject.org/projects/sssd/"
@@ -79,8 +79,7 @@ msgid ""
 msgstr ""
 "<replaceable>[раздел]</replaceable>\n"
 "<replaceable>ключ</replaceable> = <replaceable>значение</replaceable>\n"
-"<replaceable>ключ2</replaceable> = "
-"<replaceable>значение2,значение3</replaceable>\n"
+"<replaceable>ключ2</replaceable> = <replaceable>значение2,значение3</replaceable>\n"
 "            "
 
 #. type: Content of: <reference><refentry><refsect1><para>
@@ -257,15 +256,13 @@ msgstr ""
 "отладки SSSD включена служба journald, этот параметр будет игнорироваться."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358 sssd.conf.5.xml:710
-#: sssd.conf.5.xml:725 sssd.conf.5.xml:948 sssd.conf.5.xml:1066
-#: sssd.conf.5.xml:2194
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "По умолчанию: true"
 
@@ -285,14 +282,12 @@ msgstr ""
 "игнорироваться."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
-#: sssd.conf.5.xml:648 sssd.conf.5.xml:945 sssd.conf.5.xml:2097
-#: sssd.conf.5.xml:2164 sssd.conf.5.xml:4250
 msgid "Default: false"
 msgstr "По умолчанию: false"
 
@@ -332,8 +327,8 @@ msgstr ""
 "на другие типы журнала)."
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -367,9 +362,8 @@ msgstr ""
 "завершит свою работу."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
-#: sssd.conf.5.xml:1286 sssd.conf.5.xml:1763 sssd.conf.5.xml:4266
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "По умолчанию: 10"
 
@@ -408,12 +402,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
-msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
+msgid ""
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Поддерживаемые службы: nss, pam <phrase condition=\"with_sudo\">, sudo</"
 "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
@@ -422,7 +422,7 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
@@ -432,33 +432,13 @@ msgstr ""
 "Администратор должен включить разрешённые для использования службы с помощью "
 "следующей команды: «systemctl enable sssd-@service@.socket».  </phrase>"
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782 sssd.conf.5.xml:780
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (целое число)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785 sssd.conf.5.xml:783
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Количество попыток восстановления подключения службами в случае сбоя или "
-"перезапуска поставщика данных"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100 sssd.conf.5.xml:788 sssd.conf.5.xml:3722
-msgid "Default: 3"
-msgstr "По умолчанию: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domains"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -476,12 +456,12 @@ msgstr ""
 "Символ «/» использовать нельзя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562 sssd.conf.5.xml:3554
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -490,7 +470,7 @@ msgstr ""
 "содержащей имя пользователя и домен, для выделения этих частей."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -502,12 +482,12 @@ msgstr ""
 "разделе справки «РАЗДЕЛЫ ДОМЕНА»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619 sssd.conf.5.xml:3611
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622 sssd.conf.5.xml:3614
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -518,32 +498,32 @@ msgstr ""
 "создания полностью определённого имени из имени пользователя и имени домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633 sssd.conf.5.xml:3625
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634 sssd.conf.5.xml:3626
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "имя пользователя"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637 sssd.conf.5.xml:3629
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640 sssd.conf.5.xml:3632
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr "имя домена, указанное в файле конфигурации SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646 sssd.conf.5.xml:3638
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649 sssd.conf.5.xml:3641
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -553,7 +533,7 @@ msgstr ""
 "доверия IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -562,7 +542,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
@@ -571,12 +551,12 @@ msgstr ""
 "сведения об этом параметре доступны в разделе справки «РАЗДЕЛЫ ДОМЕНОВ»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr "monitor_resolv_conf (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -586,12 +566,12 @@ msgstr ""
 "сопоставителя DNS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -602,7 +582,7 @@ msgstr ""
 "этого снова будет выполняться опрос каждые пять секунд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -612,7 +592,7 @@ msgstr ""
 "В таких случаях в этот параметр следует установить значение «false»"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -621,7 +601,7 @@ msgstr ""
 "других платформах."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -631,12 +611,12 @@ msgstr ""
 "использоваться опрос."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -645,7 +625,7 @@ msgstr ""
 "повтора Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -655,7 +635,7 @@ msgstr ""
 "повтора."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -664,12 +644,12 @@ msgstr ""
 "(__LIBKRB5_DEFAULTS__, если не настроено)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr "user (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -680,7 +660,7 @@ msgstr ""
 "пользователя root. Единственное поддерживаемое значение — «&sssd_user_name;»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
@@ -690,7 +670,7 @@ msgstr ""
 "метод)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -706,18 +686,18 @@ msgstr ""
 "«&sssd_user_name;», либо от имени «root»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 "По умолчанию: не задано, процесс будет запущен от имени пользователя root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -733,7 +713,7 @@ msgstr ""
 "не указывая имя домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -757,8 +737,8 @@ msgstr ""
 "параметр default_domain_suffix.  </phrase>"
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -766,12 +746,12 @@ msgid "Default: not set"
 msgstr "По умолчанию: не задано"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr "override_space (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -787,7 +767,7 @@ msgstr ""
 "пробел является стандартным разделителем полей."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -800,22 +780,22 @@ msgstr ""
 "вернуть неизменённое имя, но в целом результат поиска будет не определён."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "По умолчанию: не задано (пробелы не будут заменены)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr "certificate_verification (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr "no_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -825,12 +805,12 @@ msgstr ""
 "сертификате серверы OCSP недоступны со стороны клиента."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr "soft_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -842,12 +822,12 @@ msgstr ""
 "связаться с ответчиком OCSP."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr "ocsp_dgst"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
@@ -856,39 +836,39 @@ msgstr ""
 "сертификата для запроса OCSP. Допустимые значения:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr "sha1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr "sha256"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr "sha384"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr "sha512"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 "По умолчанию: sha1 (для обеспечения совместимости с ответчиком, "
 "соответствующим стандарту RFC5019)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr "no_verification"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
@@ -897,12 +877,12 @@ msgstr ""
 "тестирования."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr "partial_chain"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -914,12 +894,12 @@ msgstr ""
 "сертификата, который может быть не самоподписанным."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr "ocsp_default_responder=URL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -930,12 +910,12 @@ msgstr ""
 "стандартного ответчика OCSP, например: http://example.com:80/ocsp."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr "ocsp_default_responder_signing_cert=NAME"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
@@ -944,12 +924,12 @@ msgstr ""
 "должны быть доступны в файле PEM, указанном параметром pam_cert_db_path."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr "crl_file=/ПУТЬ/К/ФАЙЛУ/CRL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -962,12 +942,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -980,7 +960,7 @@ msgstr ""
 "в автономном режиме и нельзя обновить CRL."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -991,22 +971,22 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614 sssd.conf.5.xml:612
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr "Неизвестные параметры передаются, но игнорируются."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617 sssd.conf.5.xml:615
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr "По умолчанию: не задано, то есть не ограничивать проверку сертификатов"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623 sssd.conf.5.xml:621
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr "disable_netlink (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626 sssd.conf.5.xml:624
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
@@ -1015,7 +995,7 @@ msgstr ""
 "маршрутах,адресах, ссылках и вызова определённых действий."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631 sssd.conf.5.xml:629
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
@@ -1025,17 +1005,17 @@ msgstr ""
 "«true»"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636 sssd.conf.5.xml:634
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr "По умолчанию: false (изменения netlink обнаруживаются)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641 sssd.conf.5.xml:639
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr "enable_files_domain (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644 sssd.conf.5.xml:642
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
@@ -1044,12 +1024,12 @@ msgstr ""
 "доменами неявный домен с<quote>id_provider=files</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655 sssd.conf.5.xml:653
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr "domain_resolution_order"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658 sssd.conf.5.xml:656
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -1066,7 +1046,7 @@ msgstr ""
 "будет выполняться в случайном порядке для каждого родительского домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670 sssd.conf.5.xml:668
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -1099,19 +1079,18 @@ msgstr ""
 "пользователей в разных доменах могут быть одинаковыми."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341 sssd.conf.5.xml:696
-#: sssd.conf.5.xml:1787 sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "По умолчанию: не задано"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703 sssd.conf.5.xml:701
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr "implicit_pac_responder (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706 sssd.conf.5.xml:704
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -1122,12 +1101,12 @@ msgstr ""
 "значение «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717 sssd.conf.5.xml:715
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr "core_dumpable (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720 sssd.conf.5.xml:718
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1139,17 +1118,17 @@ msgstr ""
 "доступны на справочной странице prctl:PR_SET_DUMPABLE."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732 sssd.conf.5.xml:730
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr "passkey_verification (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740 sssd.conf.5.xml:738
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr "user_verification (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742 sssd.conf.5.xml:740
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
@@ -1159,7 +1138,7 @@ msgstr ""
 "запрашиваться всегда."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748 sssd.conf.5.xml:746
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1170,7 +1149,7 @@ msgstr ""
 "перезаписано сервером."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735 sssd.conf.5.xml:733
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -1198,12 +1177,12 @@ msgstr ""
 "<quote>[sssd]</quote>. <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767 sssd.conf.5.xml:765
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "РАЗДЕЛЫ СЛУЖБ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769 sssd.conf.5.xml:767
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1216,22 +1195,22 @@ msgstr ""
 "раздел <quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776 sssd.conf.5.xml:774
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Общие параметры настройки служб"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778 sssd.conf.5.xml:776
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Эти параметры можно использовать для настройки любых служб."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795 sssd.conf.5.xml:793
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798 sssd.conf.5.xml:796
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1247,17 +1226,17 @@ msgstr ""
 "ограничением «hard» в limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807 sssd.conf.5.xml:805
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "По умолчанию: 8192 (или ограничение «hard» в limits.conf)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812 sssd.conf.5.xml:810
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815 sssd.conf.5.xml:813
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1272,17 +1251,17 @@ msgstr ""
 "на 10 секунд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824 sssd.conf.5.xml:822
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr "По умолчанию: 60, KCM: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829 sssd.conf.5.xml:827
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832 sssd.conf.5.xml:830
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1300,8 +1279,7 @@ msgstr ""
 "следующей формуле:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899 sssd.conf.5.xml:841
-#: sssd.conf.5.xml:897
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
@@ -1310,7 +1288,7 @@ msgstr ""
 "offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846 sssd.conf.5.xml:844
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1322,7 +1300,7 @@ msgstr ""
 "количество секунд до следующей попытки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852 sssd.conf.5.xml:850
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
@@ -1331,19 +1309,18 @@ msgstr ""
 "параметром offline_timeout_max (кроме случайной части)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495 sssd.conf.5.xml:854
-#: sssd.conf.5.xml:1197 sssd.conf.5.xml:1580 sssd.conf.5.xml:1876
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "По умолчанию: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861 sssd.conf.5.xml:859
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout_max (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864 sssd.conf.5.xml:862
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
@@ -1352,12 +1329,12 @@ msgstr ""
 "сеть после неудачных попыток восстановления подключения."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869 sssd.conf.5.xml:867
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr "Значение «0» отключает использование приращения."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872 sssd.conf.5.xml:870
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
@@ -1366,7 +1343,7 @@ msgstr ""
 "offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876 sssd.conf.5.xml:874
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1380,7 +1357,7 @@ msgstr ""
 "4 раза превышать значение offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882 sssd.conf.5.xml:880
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
@@ -1390,17 +1367,17 @@ msgstr ""
 "имеет практического смысла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887 sssd.conf.5.xml:885
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr "По умолчанию: 3600"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892 sssd.conf.5.xml:890
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout_random_offset (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895 sssd.conf.5.xml:893
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
@@ -1409,7 +1386,7 @@ msgstr ""
 "внутренним серверам через заданные промежутки времени:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902 sssd.conf.5.xml:900
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
@@ -1419,27 +1396,27 @@ msgstr ""
 "случайное число, принадлежащее диапазону:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907 sssd.conf.5.xml:905
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "[0 - offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910 sssd.conf.5.xml:908
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr "Значение «0» отключает добавление случайной задержки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913 sssd.conf.5.xml:911
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr "По умолчанию: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918 sssd.conf.5.xml:916
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr "responder_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921 sssd.conf.5.xml:919
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1458,19 +1435,18 @@ msgstr ""
 "активируются с помощью сокетов или D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
-#: sssd-ldap.5.xml:332 sssd.conf.5.xml:933 sssd.conf.5.xml:1210
-#: sssd.conf.5.xml:2329
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
+#: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "По умолчанию: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940 sssd.conf.5.xml:938
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr "cache_first"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943 sssd.conf.5.xml:941
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
@@ -1479,12 +1455,12 @@ msgstr ""
 "опросом поставщиков данных."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958 sssd.conf.5.xml:956
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "Параметры настройки NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960 sssd.conf.5.xml:958
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1492,12 +1468,12 @@ msgstr ""
 "(NSS)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965 sssd.conf.5.xml:963
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968 sssd.conf.5.xml:966
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1506,17 +1482,17 @@ msgstr ""
 "пользователях) в кэше nss_sss в секундах"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972 sssd.conf.5.xml:970
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "По умолчанию: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977 sssd.conf.5.xml:975
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980 sssd.conf.5.xml:978
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1527,7 +1503,7 @@ msgstr ""
 "значения entry_cache_timeout для домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986 sssd.conf.5.xml:984
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1543,7 +1519,7 @@ msgstr ""
 "ожидании обновления кэша."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996 sssd.conf.5.xml:994
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1557,18 +1533,17 @@ msgstr ""
 "значения «0» отключает эту возможность."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120 sssd.conf.5.xml:1002
-#: sssd.conf.5.xml:2118
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "По умолчанию: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009 sssd.conf.5.xml:1007
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012 sssd.conf.5.xml:1010
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1580,18 +1555,17 @@ msgstr ""
 "серверу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
-#: sssd.conf.5.xml:1016 sssd.conf.5.xml:1775 sssd.conf.5.xml:2142
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "По умолчанию: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023 sssd.conf.5.xml:1021
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr "local_negative_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026 sssd.conf.5.xml:1024
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1603,17 +1577,17 @@ msgstr ""
 "возможность."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032 sssd.conf.5.xml:1030
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr "По умолчанию: 14400 (4 часа)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037 sssd.conf.5.xml:1035
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040 sssd.conf.5.xml:1038
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1628,7 +1602,7 @@ msgstr ""
 "(UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048 sssd.conf.5.xml:1046
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1642,17 +1616,17 @@ msgstr ""
 "отфильтрованной вложенной группы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056 sssd.conf.5.xml:1054
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "По умолчанию: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061 sssd.conf.5.xml:1059
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064 sssd.conf.5.xml:1062
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1660,12 +1634,12 @@ msgstr ""
 "установите этот параметр в значение «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075 sssd.conf.5.xml:1073
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078 sssd.conf.5.xml:1076
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1674,7 +1648,7 @@ msgstr ""
 "явно не указан поставщиком данных домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083 sssd.conf.5.xml:1081
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1682,7 +1656,7 @@ msgstr ""
 "параметра override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089 sssd.conf.5.xml:1087
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1692,25 +1666,23 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
-#: sssd.conf.5.xml:1085 sssd.conf.5.xml:1647 sssd.conf.5.xml:1666
-#: sssd.conf.5.xml:1743
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "пример: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093 sssd.conf.5.xml:1091
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr "По умолчанию: не задано (без замен для незаданных домашних каталогов)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099 sssd.conf.5.xml:1097
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102 sssd.conf.5.xml:1100
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1722,19 +1694,19 @@ msgstr ""
 "домена отдельно."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108 sssd.conf.5.xml:1106
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "По умолчанию: не задано (SSSD будет использовать значение, полученное от "
 "LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114 sssd.conf.5.xml:1112
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117 sssd.conf.5.xml:1115
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1742,14 +1714,14 @@ msgstr ""
 "Порядок вычисления:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120 sssd.conf.5.xml:1118
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 "1. Если оболочка присутствует в файле <quote>/etc/shells</quote>, будет "
 "использована она."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124 sssd.conf.5.xml:1122
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1758,7 +1730,7 @@ msgstr ""
 "etc/shells</quote>, использовать значение параметра shell_fallback."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129 sssd.conf.5.xml:1127
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1767,14 +1739,14 @@ msgstr ""
 "shells</quote>, будет использована оболочка, которая не требует входа."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134 sssd.conf.5.xml:1132
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 "Чтобы разрешить использование любой оболочки, можно использовать "
 "подстановочный знак (*)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137 sssd.conf.5.xml:1135
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1785,12 +1757,12 @@ msgstr ""
 "ведение списка всех разрешённых оболочек в allowed_shells было бы излишним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144 sssd.conf.5.xml:1142
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "Пустая строка оболочки передаётся libc «как есть»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147 sssd.conf.5.xml:1145
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1799,28 +1771,28 @@ msgstr ""
 "Следовательно, в случае установки новой оболочки потребуется перезапуск SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151 sssd.conf.5.xml:1149
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 "По умолчанию: не задано. Автоматически используется оболочка пользователя."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156 sssd.conf.5.xml:1154
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159 sssd.conf.5.xml:1157
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "Заменять все экземпляры этих оболочек на shell_fallback"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164 sssd.conf.5.xml:1162
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167 sssd.conf.5.xml:1165
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1828,17 +1800,17 @@ msgstr ""
 "оболочка не установлена на компьютере."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171 sssd.conf.5.xml:1169
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "По умолчанию: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176 sssd.conf.5.xml:1174
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179 sssd.conf.5.xml:1177
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1848,7 +1820,7 @@ msgstr ""
 "разделе [nss] или для каждого домена отдельно."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185 sssd.conf.5.xml:1183
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1857,14 +1829,12 @@ msgstr ""
 "положиться на libc в плане подстановки подходящего варианта, обычно /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575 sssd.conf.5.xml:1190
-#: sssd.conf.5.xml:1573
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578 sssd.conf.5.xml:1193
-#: sssd.conf.5.xml:1576
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1873,12 +1843,12 @@ msgstr ""
 "действительным."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204 sssd.conf.5.xml:1202
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr "memcache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207 sssd.conf.5.xml:1205
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
@@ -1888,7 +1858,7 @@ msgstr ""
 "отключит кэш в памяти."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215 sssd.conf.5.xml:1213
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
@@ -1898,10 +1868,8 @@ msgstr ""
 "только для тестирования."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323 sssd.conf.5.xml:1219
-#: sssd.conf.5.xml:1244 sssd.conf.5.xml:1269 sssd.conf.5.xml:1294
-#: sssd.conf.5.xml:1321
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
@@ -1911,12 +1879,12 @@ msgstr ""
 "памяти."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229 sssd.conf.5.xml:1227
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr "memcache_size_passwd (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232 sssd.conf.5.xml:1230
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1927,15 +1895,13 @@ msgstr ""
 "памяти для запросов passwd."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
-#: sssd.conf.5.xml:1236 sssd.conf.5.xml:2982
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr "По умолчанию: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
-#: sssd.conf.5.xml:1289 sssd.conf.5.xml:1316
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
@@ -1944,12 +1910,12 @@ msgstr ""
 "значительное негативное воздействие на производительность SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254 sssd.conf.5.xml:1252
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr "memcache_size_group (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257 sssd.conf.5.xml:1255
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1960,20 +1926,19 @@ msgstr ""
 "памяти для запросов group."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
-#: include/krb5_options.xml:11 sssd.conf.5.xml:1261 sssd.conf.5.xml:1313
-#: sssd.conf.5.xml:3743
+#: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "По умолчанию: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279 sssd.conf.5.xml:1277
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr "memcache_size_initgroups (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282 sssd.conf.5.xml:1280
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1984,12 +1949,12 @@ msgstr ""
 "отключит кэш в памяти для запросов групп инициализации."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304 sssd.conf.5.xml:1302
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr "memcache_size_sid (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307 sssd.conf.5.xml:1305
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -2002,12 +1967,12 @@ msgstr ""
 "размера в значение «0» отключит кэш SID в памяти."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90 sssd.conf.5.xml:1329
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334 sssd.conf.5.xml:1332
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -2024,7 +1989,7 @@ msgstr ""
 "manvolnum> </citerefentry>), но без стандартных значений."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347 sssd.conf.5.xml:1345
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
@@ -2033,17 +1998,17 @@ msgstr ""
 "ли он для ответчика NSS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352 sssd.conf.5.xml:1350
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr "По умолчанию: не задано, использовать параметр InfoPipe"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357 sssd.conf.5.xml:1355
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr "pwfield (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360 sssd.conf.5.xml:1358
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
@@ -2052,12 +2017,12 @@ msgstr ""
 "вернут для поля <quote>password</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365 sssd.conf.5.xml:1363
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr "По умолчанию: <quote>*</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368 sssd.conf.5.xml:1366
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
@@ -2066,7 +2031,7 @@ msgstr ""
 "что будет иметь приоритет над значением в разделе [nss]."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1370
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -2078,12 +2043,12 @@ msgstr ""
 "<quote>x</quote> (домен прокси с nss_files и целью sssd-shadowutils)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384 sssd.conf.5.xml:1382
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "Параметры настройки PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386 sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -2092,12 +2057,12 @@ msgstr ""
 "проверки подлинности (PAM)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391 sssd.conf.5.xml:1389
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394 sssd.conf.5.xml:1392
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -2107,18 +2072,17 @@ msgstr ""
 "момента последнего успешного входа)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412 sssd.conf.5.xml:1397
-#: sssd.conf.5.xml:1410
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "По умолчанию: 0 (без ограничений)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1403
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408 sssd.conf.5.xml:1406
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -2127,12 +2091,12 @@ msgstr ""
 "режиме, сколько следует допускать неудачных попыток входа."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418 sssd.conf.5.xml:1416
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421 sssd.conf.5.xml:1419
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -2142,7 +2106,7 @@ msgstr ""
 "входа."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426 sssd.conf.5.xml:1424
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -2154,18 +2118,17 @@ msgstr ""
 "возможной, необходимо успешно пройти проверку подлинности в сетевом режиме."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542 sssd.conf.5.xml:1430
-#: sssd.conf.5.xml:1540
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "По умолчанию: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438 sssd.conf.5.xml:1436
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441 sssd.conf.5.xml:1439
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -2174,43 +2137,43 @@ msgstr ""
 "подлинности. Чем больше число, тем больше сообщений будет показано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446 sssd.conf.5.xml:1444
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "В настоящее время sssd поддерживает следующие значения:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449 sssd.conf.5.xml:1447
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: не показывать никаких сообщений"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452 sssd.conf.5.xml:1450
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: показывать только важные сообщения"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456 sssd.conf.5.xml:1454
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: показывать информационные сообщения"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459 sssd.conf.5.xml:1457
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: показывать все сообщения и отладочную информацию"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63 sssd.conf.5.xml:1461
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "По умолчанию: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469 sssd.conf.5.xml:1467
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr "pam_response_filter (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472 sssd.conf.5.xml:1470
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2224,7 +2187,7 @@ msgstr ""
 "установлены pam_sss)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480 sssd.conf.5.xml:1478
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
@@ -2233,37 +2196,37 @@ msgstr ""
 "параметр позволяет отфильтровать также и другие типы ответов."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487 sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr "ENV"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488 sssd.conf.5.xml:1486
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr "Не отправлять никаким службам никакие переменные среды."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491 sssd.conf.5.xml:1489
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr "ENV:var_name"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492 sssd.conf.5.xml:1490
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr "Не отправлять переменную среды var_name никаким службам."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496 sssd.conf.5.xml:1494
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr "ENV:var_name:service"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497 sssd.conf.5.xml:1495
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr "Не отправлять переменную среды var_name указанной службе."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485 sssd.conf.5.xml:1483
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -2272,7 +2235,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504 sssd.conf.5.xml:1502
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2290,23 +2253,23 @@ msgstr ""
 "префикса только для части элементов списка считается ошибкой."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515 sssd.conf.5.xml:1513
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr "По умолчанию: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518 sssd.conf.5.xml:1516
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr "Пример: -ENV:KRB5CCNAME:sudo-i удалит фильтр из списка стандартных"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525 sssd.conf.5.xml:1523
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528 sssd.conf.5.xml:1526
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2318,7 +2281,7 @@ msgstr ""
 "данные."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534 sssd.conf.5.xml:1532
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2332,18 +2295,17 @@ msgstr ""
 "обменов данными с поставщиком данных идентификации."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548 sssd.conf.5.xml:1546
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014 sssd.conf.5.xml:1549
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "Показать предупреждение за N дней до истечения срока действия пароля."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554 sssd.conf.5.xml:1552
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2354,8 +2316,7 @@ msgstr ""
 "сможет показать предупреждение."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017 sssd.conf.5.xml:1558
-#: sssd.conf.5.xml:3009
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2365,7 +2326,7 @@ msgstr ""
 "показано автоматически."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565 sssd.conf.5.xml:1563
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2374,18 +2335,18 @@ msgstr ""
 "<emphasis>pwd_expiration_warning</emphasis> для конкретного домена."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
-#: sssd.conf.5.xml:1568 sssd.conf.5.xml:4009
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "По умолчанию: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587 sssd.conf.5.xml:1585
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590 sssd.conf.5.xml:1588
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2400,12 +2361,12 @@ msgstr ""
 "quote>. Имена пользователей разрешаются в UID при запуске."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600 sssd.conf.5.xml:1598
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr "По умолчанию: все пользователи считаются доверенными по умолчанию"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604 sssd.conf.5.xml:1602
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
@@ -2414,12 +2375,12 @@ msgstr ""
 "если этот идентификатор пользователя отсутствует в списке pam_trusted_users."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611 sssd.conf.5.xml:1609
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614 sssd.conf.5.xml:1612
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
@@ -2428,12 +2389,12 @@ msgstr ""
 "недоверенных пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618 sssd.conf.5.xml:1616
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr "Для параметра pam_public_domains определены два специальных значения:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622 sssd.conf.5.xml:1620
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
@@ -2441,7 +2402,7 @@ msgstr ""
 "PAM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626 sssd.conf.5.xml:1624
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2450,21 +2411,19 @@ msgstr ""
 "PAM)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209 sssd.conf.5.xml:1628 sssd.conf.5.xml:1653
-#: sssd.conf.5.xml:1672 sssd.conf.5.xml:1909 sssd.conf.5.xml:2744
-#: sssd.conf.5.xml:3938
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "По умолчанию: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635 sssd.conf.5.xml:1633
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638 sssd.conf.5.xml:1636
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
@@ -2473,7 +2432,7 @@ msgstr ""
 "которое заменит стандартное сообщение «Доступ запрещён»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
@@ -2483,7 +2442,7 @@ msgstr ""
 "«3» (показывать все сообщения и отладочную информацию)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651 sssd.conf.5.xml:1649
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2493,12 +2452,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660 sssd.conf.5.xml:1658
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr "pam_account_locked_message (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663 sssd.conf.5.xml:1661
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
@@ -2507,7 +2466,7 @@ msgstr ""
 "стандартное сообщение «Доступ запрещён»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670 sssd.conf.5.xml:1668
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2517,47 +2476,46 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679 sssd.conf.5.xml:1677
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr "pam_passkey_auth (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682 sssd.conf.5.xml:1680
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr "Включить аутентификацию на основе ключа доступа."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
-#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145 sssd.conf.5.xml:1683
-#: sssd.conf.5.xml:1995
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
+#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "По умолчанию: true"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690 sssd.conf.5.xml:1688
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr "passkey_debug_libfido2 (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693 sssd.conf.5.xml:1691
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr "Включить отладочные сообщения библиотеки libfido2."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
-#: include/ldap_id_mapping.xml:250 sssd.conf.5.xml:1694 sssd.conf.5.xml:1708
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
+#: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "По умолчанию: false"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701 sssd.conf.5.xml:1699
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr "pam_cert_auth (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704 sssd.conf.5.xml:1702
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2568,24 +2526,22 @@ msgstr ""
 "задержит процесс проверки подлинности, по умолчанию этот параметр отключён."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715 sssd.conf.5.xml:1713
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr "pam_cert_db_path (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718 sssd.conf.5.xml:1716
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr "Путь к базе данных сертификатов."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
-#: sssd.conf.5.xml:1719 sssd.conf.5.xml:2244 sssd.conf.5.xml:4430
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr "По умолчанию:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248 sssd.conf.5.xml:1721
-#: sssd.conf.5.xml:2246
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
@@ -2594,12 +2550,12 @@ msgstr ""
 "CA в формате PEM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733 sssd.conf.5.xml:1731
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr "pam_cert_verification (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736 sssd.conf.5.xml:1734
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2614,7 +2570,7 @@ msgstr ""
 "<quote>certificate_verification</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747 sssd.conf.5.xml:1745
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2624,7 +2580,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751 sssd.conf.5.xml:1749
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
@@ -2634,24 +2590,24 @@ msgstr ""
 "quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758 sssd.conf.5.xml:1756
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr "p11_child_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761 sssd.conf.5.xml:1759
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 "Разрешённое количество секунд, в течение которого pam_sss ожидает завершения "
 "работы p11_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770 sssd.conf.5.xml:1768
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr "passkey_child_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773 sssd.conf.5.xml:1771
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
@@ -2659,12 +2615,12 @@ msgstr ""
 "завершения работы passkey_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782 sssd.conf.5.xml:1780
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr "pam_app_services (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785 sssd.conf.5.xml:1783
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
@@ -2673,12 +2629,12 @@ msgstr ""
 "типа <quote>application</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794 sssd.conf.5.xml:1792
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr "pam_p11_allowed_services (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797 sssd.conf.5.xml:1795
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
@@ -2687,7 +2643,7 @@ msgstr ""
 "использовать смарт-карты."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812 sssd.conf.5.xml:1810
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2697,7 +2653,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801 sssd.conf.5.xml:1799
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2716,63 +2672,63 @@ msgstr ""
 "конфигурацию: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947 sssd.conf.5.xml:1814
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr "По умолчанию: стандартный набор имён служб PAM включает:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648 sssd.conf.5.xml:1819
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653 sssd.conf.5.xml:1824
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658 sssd.conf.5.xml:1829
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673 sssd.conf.5.xml:1834
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668 sssd.conf.5.xml:1839
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678 sssd.conf.5.xml:1844
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956 sssd.conf.5.xml:1849
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961 sssd.conf.5.xml:1854
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861 sssd.conf.5.xml:1859
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr "gnome-screensaver"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869 sssd.conf.5.xml:1867
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872 sssd.conf.5.xml:1870
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2783,12 +2739,12 @@ msgstr ""
 "p11_child_timeout) ответчик PAM должен ожидать вставки смарт-карты."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883 sssd.conf.5.xml:1881
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr "p11_uri (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886 sssd.conf.5.xml:1884
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2806,7 +2762,7 @@ msgstr ""
 "чтения."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899 sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2816,7 +2772,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903 sssd.conf.5.xml:1901
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2826,7 +2782,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897 sssd.conf.5.xml:1895
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2840,17 +2796,17 @@ msgstr ""
 "URI PKCS#11."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916 sssd.conf.5.xml:1914
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr "pam_initgroups_scheme"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924 sssd.conf.5.xml:1922
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr "always"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925 sssd.conf.5.xml:1923
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
@@ -2858,12 +2814,12 @@ msgstr ""
 "pam_id_timeout всё равно применяется)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929 sssd.conf.5.xml:1927
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr "no_session"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930 sssd.conf.5.xml:1928
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
@@ -2872,12 +2828,12 @@ msgstr ""
 "то есть тогда, когда пользователь не находится в системе"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935 sssd.conf.5.xml:1933
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr "never"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936 sssd.conf.5.xml:1934
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
@@ -2886,7 +2842,7 @@ msgstr ""
 "до тех пор, пока они не устареют"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919 sssd.conf.5.xml:1917
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2899,18 +2855,17 @@ msgstr ""
 "допустимые значения: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943 sssd.conf.5.xml:1941
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr "По умолчанию: no_session"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377 sssd.conf.5.xml:1946
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr "pam_gssapi_services"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951 sssd.conf.5.xml:1949
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
@@ -2919,7 +2874,7 @@ msgstr ""
 "проверку подлинности по GSSAPI с помощью модуля pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956 sssd.conf.5.xml:1954
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
@@ -2927,8 +2882,7 @@ msgstr ""
 "параметр в значение <quote>-</quote> (дефис)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
-#: sssd.conf.5.xml:1958 sssd.conf.5.xml:1989 sssd.conf.5.xml:2027
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2940,7 +2894,7 @@ msgstr ""
 "в разделе домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968 sssd.conf.5.xml:1966
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2950,24 +2904,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940 sssd.conf.5.xml:1964
-#: sssd.conf.5.xml:3932
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Пример: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972 sssd.conf.5.xml:1970
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr "По умолчанию: - (проверка подлинности с помощью GSSAPI отключена)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378 sssd.conf.5.xml:1975
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr "pam_gssapi_check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980 sssd.conf.5.xml:1978
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2979,7 +2931,7 @@ msgstr ""
 "такой привязки нет, проверка подлинности завершится ошибкой."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987 sssd.conf.5.xml:1985
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
@@ -2988,12 +2940,12 @@ msgstr ""
 "пользователей, получивших необходимый билет службы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002 sssd.conf.5.xml:2000
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr "pam_gssapi_indicators_map"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005 sssd.conf.5.xml:2003
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -3005,7 +2957,7 @@ msgstr ""
 "pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011 sssd.conf.5.xml:2009
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -3032,7 +2984,7 @@ msgstr ""
 "доступ."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024 sssd.conf.5.xml:2022
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -3044,7 +2996,7 @@ msgstr ""
 "<quote>service:-</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035 sssd.conf.5.xml:2033
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
@@ -3053,7 +3005,7 @@ msgstr ""
 "индикаторов проверки подлинности:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038 sssd.conf.5.xml:2036
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
@@ -3062,7 +3014,7 @@ msgstr ""
 "которые хранятся в файлах или на смарт-картах."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041 sssd.conf.5.xml:2039
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
@@ -3071,13 +3023,13 @@ msgstr ""
 "предварительная проверка подлинности, помещённая в канал FAST."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044 sssd.conf.5.xml:2042
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 "radius — предварительная проверка подлинности с помощью сервера RADIUS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047 sssd.conf.5.xml:2045
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
@@ -3086,14 +3038,14 @@ msgstr ""
 "двухфакторной аутентификации (2FA или одноразовый пароль, OTP) в IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050 sssd.conf.5.xml:2048
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 "idp -- предварительная аутентификация с использованием внешнего поставщика "
 "удостоверений."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060 sssd.conf.5.xml:2058
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -3103,7 +3055,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055 sssd.conf.5.xml:2053
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -3115,19 +3067,19 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064 sssd.conf.5.xml:2062
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 "По умолчанию: не задано (использование индикаторов проверки подлинности не "
 "требуется)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2070
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "Параметры настройки SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074 sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -3144,12 +3096,12 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091 sssd.conf.5.xml:2089
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094 sssd.conf.5.xml:2092
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -3158,12 +3110,12 @@ msgstr ""
 "предназначенные для определения временных ограничений для записей sudoers."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106 sssd.conf.5.xml:2104
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr "sudo_threshold (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109 sssd.conf.5.xml:2107
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -3179,22 +3131,22 @@ msgstr ""
 "к поискам команд и групп команд sudo IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128 sssd.conf.5.xml:2126
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "Параметры настройки AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130 sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr "Эти параметры можно использовать для настройки службы autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134 sssd.conf.5.xml:2132
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137 sssd.conf.5.xml:2135
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -3205,22 +3157,22 @@ msgstr ""
 "например, несуществующих) перед повторным запросом к внутреннему серверу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153 sssd.conf.5.xml:2151
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "Параметры настройки SSH"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155 sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr "Эти параметры можно использовать для настройки службы SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159 sssd.conf.5.xml:2157
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162 sssd.conf.5.xml:2160
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -3228,12 +3180,12 @@ msgstr ""
 "Следует ли хэшировать имена и адреса узлов в управляемом файле known_hosts."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171 sssd.conf.5.xml:2169
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174 sssd.conf.5.xml:2172
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -3242,17 +3194,17 @@ msgstr ""
 "управляемом файле known_hosts после запроса ключей этого узла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178 sssd.conf.5.xml:2176
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "По умолчанию: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183 sssd.conf.5.xml:2181
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr "ssh_use_certificate_keys (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186 sssd.conf.5.xml:2184
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -3266,12 +3218,12 @@ msgstr ""
 "<manvolnum>1</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201 sssd.conf.5.xml:2199
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr "ssh_use_certificate_matching_rules (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204 sssd.conf.5.xml:2202
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -3287,7 +3239,7 @@ msgstr ""
 "другие правила будут игнорироваться."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213 sssd.conf.5.xml:2211
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -3299,7 +3251,7 @@ msgstr ""
 "ключи SSH будут создаваться на основе всех действительных сертификатов."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220 sssd.conf.5.xml:2218
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -3313,7 +3265,7 @@ msgstr ""
 "подлинности сертификатов."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227 sssd.conf.5.xml:2225
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
@@ -3322,7 +3274,7 @@ msgstr ""
 "выбрано ни одного правила, все сертификаты будут проигнорированы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232 sssd.conf.5.xml:2230
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
@@ -3331,12 +3283,12 @@ msgstr ""
 "правила или правило по умолчанию"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238 sssd.conf.5.xml:2236
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr "ca_db (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241 sssd.conf.5.xml:2239
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
@@ -3346,12 +3298,12 @@ msgstr ""
 "SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261 sssd.conf.5.xml:2259
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "Параметры настройки ответчика PAC"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263 sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -3369,7 +3321,7 @@ msgstr ""
 "обрабатывается, выполняются некоторые из следующих операций:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272 sssd.conf.5.xml:2270
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -3386,7 +3338,7 @@ msgstr ""
 "можно переопределить с помощью параметра default_shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280 sssd.conf.5.xml:2278
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3395,17 +3347,17 @@ msgstr ""
 "добавлен в эти группы."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286 sssd.conf.5.xml:2284
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr "Эти параметры можно использовать для настройки ответчика PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66 sssd.conf.5.xml:2288
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293 sssd.conf.5.xml:2291
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3416,7 +3368,7 @@ msgstr ""
 "запуске."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299 sssd.conf.5.xml:2297
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
@@ -3425,13 +3377,13 @@ msgstr ""
 "root и пользователям службы SSSD)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303 sssd.conf.5.xml:2301
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "По умолчанию: 0 (доступ к ответчику PAC разрешён только пользователю root)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307 sssd.conf.5.xml:2305
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -3444,7 +3396,7 @@ msgstr ""
 "случай), необходимо явно добавить их в список разрешенных UID."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314 sssd.conf.5.xml:2312
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3458,12 +3410,12 @@ msgstr ""
 "доступ."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323 sssd.conf.5.xml:2321
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr "pac_lifetime (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326 sssd.conf.5.xml:2324
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
@@ -3472,12 +3424,12 @@ msgstr ""
 "PAC можно использовать для определения участия пользователя в группах."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336 sssd.conf.5.xml:2334
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr "pac_check (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339 sssd.conf.5.xml:2337
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3495,12 +3447,12 @@ msgstr ""
 "пропущена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353 sssd.conf.5.xml:2351
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr "no_check"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355 sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
@@ -3509,12 +3461,12 @@ msgstr ""
 "проверки выполняться не будут."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361 sssd.conf.5.xml:2359
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr "pac_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363 sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3525,12 +3477,12 @@ msgstr ""
 "ошибкой."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371 sssd.conf.5.xml:2369
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr "check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373 sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
@@ -3539,12 +3491,12 @@ msgstr ""
 "пользователя (UPN) верна."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379 sssd.conf.5.xml:2377
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr "check_upn_allow_missing"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381 sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3564,7 +3516,7 @@ msgstr ""
 "устанавливать 'ldap_user_principal'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393 sssd.conf.5.xml:2391
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3581,24 +3533,24 @@ msgstr ""
 "пропуску проверки и сообщение не появится в журнале."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407 sssd.conf.5.xml:2405
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr "upn_dns_info_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409 sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 "PAC должен содержать буфер UPN-DNS-INFO, неявным образом устанавливает "
 "'check_upn'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414 sssd.conf.5.xml:2412
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr "check_upn_dns_info_ex"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416 sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
@@ -3607,12 +3559,12 @@ msgstr ""
 "согласованы ли данные в расширении."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423 sssd.conf.5.xml:2421
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr "upn_dns_info_ex_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425 sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
@@ -3621,7 +3573,7 @@ msgstr ""
 "устанавливает 'check_upn_dns_info_ex', 'upn_dns_info_present' и 'check_upn'."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349 sssd.conf.5.xml:2347
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3630,7 +3582,7 @@ msgstr ""
 "запятыми списка: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435 sssd.conf.5.xml:2433
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
@@ -3639,12 +3591,12 @@ msgstr ""
 "check_upn_allow_missing, check_upn_dns_info_ex')"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444 sssd.conf.5.xml:2442
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr "Параметры настройки записи сеансов"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446 sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3660,32 +3612,32 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459 sssd.conf.5.xml:2457
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr "Эти параметры можно использовать для настройки записи сеансов."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64 sssd.conf.5.xml:2461
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr "scope (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71 sssd.conf.5.xml:2468
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr "«none»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74 sssd.conf.5.xml:2471
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr "Пользователи не записываются."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79 sssd.conf.5.xml:2476
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr "«some»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82 sssd.conf.5.xml:2479
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
@@ -3694,17 +3646,17 @@ msgstr ""
 "<replaceable>users</replaceable> и <replaceable>groups</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91 sssd.conf.5.xml:2488
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr "«all»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94 sssd.conf.5.xml:2491
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr "Записываются все пользователи."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67 sssd.conf.5.xml:2464
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3713,17 +3665,17 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101 sssd.conf.5.xml:2498
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr "По умолчанию: «none»"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106 sssd.conf.5.xml:2503
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr "users (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109 sssd.conf.5.xml:2506
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3735,17 +3687,17 @@ msgstr ""
 "так далее."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115 sssd.conf.5.xml:2512
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr "По умолчанию: пусто. Не соответствует ни одному пользователю."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120 sssd.conf.5.xml:2517
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr "groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123 sssd.conf.5.xml:2520
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3756,8 +3708,8 @@ msgstr ""
 "NSS, то есть после возможной замены пробелов, смены регистра и так далее."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
-#: sssd-session-recording.5.xml:161 sssd.conf.5.xml:2526 sssd.conf.5.xml:2558
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
+#: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
 "performance cost, because each uncached request for a user requires "
@@ -3769,17 +3721,17 @@ msgstr ""
 "установление соответствия групп, участником которых он является."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136 sssd.conf.5.xml:2533
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr "По умолчанию: пусто. Не соответствует ни одной группе."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141 sssd.conf.5.xml:2538
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr "exclude_users (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144 sssd.conf.5.xml:2541
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
@@ -3788,17 +3740,17 @@ msgstr ""
 "применимо только при «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148 sssd.conf.5.xml:2545
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr "По умолчанию: пусто. Не исключается ни один пользователь."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153 sssd.conf.5.xml:2550
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr "exclude_groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156 sssd.conf.5.xml:2553
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
@@ -3807,24 +3759,23 @@ msgstr ""
 "применимо только при «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168 sssd.conf.5.xml:2565
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr "По умолчанию: пусто. Не исключается ни одна группа."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577 sssd.conf.5.xml:2575
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "РАЗДЕЛЫ ДОМЕНА"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072 sssd.conf.5.xml:2582 sssd.conf.5.xml:4060
-#: sssd.conf.5.xml:4061 sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr "enabled"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587 sssd.conf.5.xml:2585
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3839,12 +3790,12 @@ msgstr ""
 "параметра domains в разделе <quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599 sssd.conf.5.xml:2597
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr "domain_type (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602 sssd.conf.5.xml:2600
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3857,7 +3808,7 @@ msgstr ""
 "операционной системы доступны только объекты из доменов POSIX."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610 sssd.conf.5.xml:2608
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
@@ -3866,7 +3817,7 @@ msgstr ""
 "<quote>application</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614 sssd.conf.5.xml:2612
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3878,7 +3829,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) и ответчика PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622 sssd.conf.5.xml:2620
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
@@ -3887,7 +3838,7 @@ msgstr ""
 "с <quote>id_provider=ldap</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626 sssd.conf.5.xml:2624
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
@@ -3896,17 +3847,17 @@ msgstr ""
 "<quote>Домены приложений</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630 sssd.conf.5.xml:2628
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr "По умолчанию: posix"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636 sssd.conf.5.xml:2634
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639 sssd.conf.5.xml:2637
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3915,7 +3866,7 @@ msgstr ""
 "находящуюся вне указанного диапазона, она будет проигнорирована."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644 sssd.conf.5.xml:2642
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3929,7 +3880,7 @@ msgstr ""
 "группы, будут выведены в обычном режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2649
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3938,17 +3889,17 @@ msgstr ""
 "кэш, а не только на их возврат по имени или идентификатору."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655 sssd.conf.5.xml:2653
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "По умолчанию: 1 для min_id, 0 (без ограничений) для max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661 sssd.conf.5.xml:2659
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664 sssd.conf.5.xml:2662
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3961,23 +3912,22 @@ msgstr ""
 "вторичных групп. Этот параметр может иметь одно из следующих значений:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672 sssd.conf.5.xml:2670
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = пользователи и группы перечисляются"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675 sssd.conf.5.xml:2673
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = для этого домена не выполняется перечисление"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
-#: sssd.conf.5.xml:2676 sssd.conf.5.xml:2961 sssd.conf.5.xml:3138
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "По умолчанию: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681 sssd.conf.5.xml:2679
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
@@ -3986,7 +3936,7 @@ msgstr ""
 "сохранить ВСЕ записи пользователей и групп с удалённого сервера."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
@@ -3995,7 +3945,7 @@ msgstr ""
 "id_provider = proxy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690 sssd.conf.5.xml:2688
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -4019,7 +3969,7 @@ msgstr ""
 "перезапущен внутренним сторожевым таймером."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705 sssd.conf.5.xml:2703
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -4028,7 +3978,7 @@ msgstr ""
 "или групп могут не вернуть результатов до момента завершения перечисления."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710 sssd.conf.5.xml:2708
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -4042,7 +3992,7 @@ msgstr ""
 "идентификаторов (id_provider)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718 sssd.conf.5.xml:2716
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -4051,7 +4001,7 @@ msgstr ""
 "средах большого размера."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -4063,32 +4013,32 @@ msgstr ""
 "этой конфигурации."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732 sssd.conf.5.xml:2724
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739 sssd.conf.5.xml:2731
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740 sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Выполнить перечисление для всех обнаруженных доверенных доменов"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743 sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744 sssd.conf.5.xml:2736
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Не выполнять перечисление для обнаруженных доверенных доменов"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735 sssd.conf.5.xml:2727
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -4102,12 +4052,12 @@ msgstr ""
 "только для них."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758 sssd.conf.5.xml:2750
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761 sssd.conf.5.xml:2753
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -4116,7 +4066,7 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765 sssd.conf.5.xml:2757
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -4133,17 +4083,17 @@ msgstr ""
 "уже были кэшированы."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778 sssd.conf.5.xml:2770
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "По умолчанию: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784 sssd.conf.5.xml:2776
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787 sssd.conf.5.xml:2779
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -4153,22 +4103,19 @@ msgstr ""
 "серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
-#: sssd.conf.5.xml:2783 sssd.conf.5.xml:2796 sssd.conf.5.xml:2809
-#: sssd.conf.5.xml:2822 sssd.conf.5.xml:2836 sssd.conf.5.xml:2849
-#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2877 sssd.conf.5.xml:2890
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "По умолчанию: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797 sssd.conf.5.xml:2789
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800 sssd.conf.5.xml:2792
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -4177,12 +4124,12 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810 sssd.conf.5.xml:2802
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813 sssd.conf.5.xml:2805
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -4191,12 +4138,12 @@ msgstr ""
 "групп действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823 sssd.conf.5.xml:2815
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826 sssd.conf.5.xml:2818
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -4205,12 +4152,12 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836 sssd.conf.5.xml:2828
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr "entry_cache_resolver_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839 sssd.conf.5.xml:2831
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
@@ -4219,12 +4166,12 @@ msgstr ""
 "сетей действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850 sssd.conf.5.xml:2842
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853 sssd.conf.5.xml:2845
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -4233,12 +4180,12 @@ msgstr ""
 "действительными, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2855
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866 sssd.conf.5.xml:2858
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -4248,12 +4195,12 @@ msgstr ""
 "внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877 sssd.conf.5.xml:2869
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880 sssd.conf.5.xml:2872
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -4263,12 +4210,12 @@ msgstr ""
 "узла в кэше."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891 sssd.conf.5.xml:2883
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr "entry_cache_computer_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894 sssd.conf.5.xml:2886
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
@@ -4277,12 +4224,12 @@ msgstr ""
 "компьютера, прежде чем снова обратиться к внутреннему серверу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904 sssd.conf.5.xml:2896
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907 sssd.conf.5.xml:2899
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -4291,7 +4238,7 @@ msgstr ""
 "обновления всех устаревших или почти устаревших записей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912 sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -4305,18 +4252,18 @@ msgstr ""
 "пользователя в группах, обычно выполняется при запуске)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920 sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr "Этот параметр автоматически наследуется для всех доверенных доменов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924 sssd.conf.5.xml:2916
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 "Рекомендуется установить это значение равным 3/4 * entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928 sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -4337,18 +4284,18 @@ msgstr ""
 "существующего кэша."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
-#: sssd-ipa.5.xml:270 sssd.conf.5.xml:2933
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
+#: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "По умолчанию: 0 (отключено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947 sssd.conf.5.xml:2939
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950 sssd.conf.5.xml:2942
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -4365,7 +4312,7 @@ msgstr ""
 "аутентификация записывается в кэш без дополнительной настройки."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961 sssd.conf.5.xml:2953
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -4379,12 +4326,12 @@ msgstr ""
 "пароль с помощью атаки грубой силы."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975 sssd.conf.5.xml:2967
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr "cache_credentials_minimal_first_factor_length (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978 sssd.conf.5.xml:2970
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -4396,7 +4343,7 @@ msgstr ""
 "сохранён в формате контрольной суммы SHA512 в кэше."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985 sssd.conf.5.xml:2977
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
@@ -4406,12 +4353,12 @@ msgstr ""
 "мишенью для атак методом подбора."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996 sssd.conf.5.xml:2988
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999 sssd.conf.5.xml:2991
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -4424,17 +4371,17 @@ msgstr ""
 "быть больше или равно значению offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006 sssd.conf.5.xml:2998
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "По умолчанию: 0 (без ограничений)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011 sssd.conf.5.xml:3003
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -4447,17 +4394,17 @@ msgstr ""
 "настроить поставщика данных проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029 sssd.conf.5.xml:3021
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "По умолчанию: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035 sssd.conf.5.xml:3027
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038 sssd.conf.5.xml:3030
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -4465,12 +4412,12 @@ msgstr ""
 "Поддерживаемые поставщики ID:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042 sssd.conf.5.xml:3034
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr "<quote>proxy</quote>: поддержка устаревшего поставщика NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045 sssd.conf.5.xml:3037
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4482,7 +4429,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053 sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4493,9 +4440,8 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286 sssd.conf.5.xml:3053 sssd.conf.5.xml:3164
-#: sssd.conf.5.xml:3215 sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4507,9 +4453,8 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295 sssd.conf.5.xml:3062 sssd.conf.5.xml:3173
-#: sssd.conf.5.xml:3224 sssd.conf.5.xml:3287
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4520,12 +4465,12 @@ msgstr ""
 "ad</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081 sssd.conf.5.xml:3073
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084 sssd.conf.5.xml:3076
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4534,7 +4479,7 @@ msgstr ""
 "домена) в качестве имени для входа пользователя, которое сообщается NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089 sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4548,7 +4493,7 @@ msgstr ""
 "passwd test@LOCAL</command> получится это сделать."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097 sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4559,7 +4504,7 @@ msgstr ""
 "групп выполняется поиск во всех доменах, когда запрашивается неполное имя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104 sssd.conf.5.xml:3096
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
@@ -4568,17 +4513,17 @@ msgstr ""
 "использования default_domain_suffix)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111 sssd.conf.5.xml:3103
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3106
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr "Не возвращать участников групп для поиска групп."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117 sssd.conf.5.xml:3109
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4597,7 +4542,7 @@ msgstr ""
 "запрошенную группу так, как будто она пуста."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135 sssd.conf.5.xml:3127
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4608,12 +4553,11 @@ msgstr ""
 "количество участников)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086 sssd.conf.5.xml:3133
-#: sssd.conf.5.xml:3854
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
@@ -4622,12 +4566,12 @@ msgstr ""
 "унаследован с помощью <emphasis>subdomain_inherit</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151 sssd.conf.5.xml:3143
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4636,8 +4580,7 @@ msgstr ""
 "Поддерживаемые поставщики данных для проверки подлинности:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216 sssd.conf.5.xml:3150
-#: sssd.conf.5.xml:3208
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4648,7 +4591,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165 sssd.conf.5.xml:3157
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4660,7 +4603,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189 sssd.conf.5.xml:3181
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
@@ -4668,12 +4611,12 @@ msgstr ""
 "PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192 sssd.conf.5.xml:3184
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> — явно отключить проверку подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195 sssd.conf.5.xml:3187
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4682,12 +4625,12 @@ msgstr ""
 "задан и поддерживает обработку запросов проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201 sssd.conf.5.xml:3193
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4698,7 +4641,7 @@ msgstr ""
 "включены в установленные внутренние серверы). Внутренние особые поставщики:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210 sssd.conf.5.xml:3202
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4707,12 +4650,12 @@ msgstr ""
 "разрешённого доступа для локального домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> — всегда отказывать в доступе."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240 sssd.conf.5.xml:3232
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4725,7 +4668,7 @@ msgstr ""
 "<manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247 sssd.conf.5.xml:3239
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4736,23 +4679,23 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254 sssd.conf.5.xml:3246
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 "<quote>proxy</quote> — передать управление доступом другому модулю PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257 sssd.conf.5.xml:3249
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "По умолчанию: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262 sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265 sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4761,7 +4704,7 @@ msgstr ""
 "домена. Поддерживаемые поставщики данных смены пароля:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270 sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4772,7 +4715,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278 sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4783,19 +4726,19 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303 sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 "<quote>proxy</quote> — передать смену пароля какой-либо другой цели PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307 sssd.conf.5.xml:3299
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> — явно запретить смену пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310 sssd.conf.5.xml:3302
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4804,19 +4747,19 @@ msgstr ""
 "задан и поддерживает обработку запросов смены пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317 sssd.conf.5.xml:3309
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320 sssd.conf.5.xml:3312
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "Поставщик данных SUDO, который используется для домена. Поддерживаемые "
 "поставщики данных SUDO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324 sssd.conf.5.xml:3316
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4827,7 +4770,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332 sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4836,7 +4779,7 @@ msgstr ""
 "параметрами IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336 sssd.conf.5.xml:3328
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4845,22 +4788,20 @@ msgstr ""
 "параметрами AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340 sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> — явно отключить SUDO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555 sssd.conf.5.xml:3335
-#: sssd.conf.5.xml:3421 sssd.conf.5.xml:3486 sssd.conf.5.xml:3511
-#: sssd.conf.5.xml:3547
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "По умолчанию: использовать значение <quote>id_provider</quote>, если этот "
 "параметр задан."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347 sssd.conf.5.xml:3339
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4878,7 +4819,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362 sssd.conf.5.xml:3354
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4892,12 +4833,12 @@ msgstr ""
 "планируется использовать sudo."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372 sssd.conf.5.xml:3364
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375 sssd.conf.5.xml:3367
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4908,7 +4849,7 @@ msgstr ""
 "работы поставщика доступа. Поддерживаемые поставщики данных SELinux:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381 sssd.conf.5.xml:3373
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4919,12 +4860,12 @@ msgstr ""
 "ipa</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389 sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr "<quote>none</quote> — явно отключает получение параметров SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392 sssd.conf.5.xml:3384
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4933,12 +4874,12 @@ msgstr ""
 "задан и поддерживает обработку запросов загрузки параметров SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398 sssd.conf.5.xml:3390
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401 sssd.conf.5.xml:3393
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4948,7 +4889,7 @@ msgstr ""
 "Поддерживаемые поставщики данных поддоменов:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407 sssd.conf.5.xml:3399
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4959,7 +4900,7 @@ msgstr ""
 "ipa</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416 sssd.conf.5.xml:3408
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4972,17 +4913,17 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425 sssd.conf.5.xml:3417
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "<quote>none</quote> — явно отключает получение данных поддоменов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435 sssd.conf.5.xml:3427
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr "session_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438 sssd.conf.5.xml:3430
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4994,14 +4935,14 @@ msgstr ""
 "Commander (работает только c IPA). Поддерживаемые поставщики данных сеансов:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445 sssd.conf.5.xml:3437
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 "<quote>ipa</quote> — разрешить выполнение заданий, связанных с сеансами "
 "пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449 sssd.conf.5.xml:3441
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
@@ -5009,7 +4950,7 @@ msgstr ""
 "пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453 sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
@@ -5018,12 +4959,12 @@ msgstr ""
 "задан и поддерживает выполнение заданий, связанных с сеансами."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460 sssd.conf.5.xml:3452
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463 sssd.conf.5.xml:3455
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -5031,7 +4972,7 @@ msgstr ""
 "поставщики данных autofs:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467 sssd.conf.5.xml:3459
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5042,7 +4983,7 @@ msgstr ""
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474 sssd.conf.5.xml:3466
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5053,7 +4994,7 @@ msgstr ""
 "ipa</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482 sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5065,17 +5006,17 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491 sssd.conf.5.xml:3483
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> — явно отключить autofs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501 sssd.conf.5.xml:3493
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504 sssd.conf.5.xml:3496
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -5084,7 +5025,7 @@ msgstr ""
 "узла. Поддерживаемые поставщики hostid:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508 sssd.conf.5.xml:3500
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -5096,17 +5037,17 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516 sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> — явно отключить hostid."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526 sssd.conf.5.xml:3518
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr "resolver_provider (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529 sssd.conf.5.xml:3521
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
@@ -5115,7 +5056,7 @@ msgstr ""
 "Поддерживаемые поставщики данных сопоставления:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533 sssd.conf.5.xml:3525
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
@@ -5124,7 +5065,7 @@ msgstr ""
 "NSS. См. <quote>proxy_resolver_lib_name</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537 sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -5136,7 +5077,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544 sssd.conf.5.xml:3536
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -5149,12 +5090,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr "<quote>none</quote> — явно отключает получение записей узлов и сетей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565 sssd.conf.5.xml:3557
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -5169,7 +5110,7 @@ msgstr ""
 "домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574 sssd.conf.5.xml:3566
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
@@ -5179,19 +5120,17 @@ msgstr ""
 "пользователей:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593 sssd.conf.5.xml:3571
-#: sssd.conf.5.xml:3585
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596 sssd.conf.5.xml:3574
-#: sssd.conf.5.xml:3588
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "username@domain.name"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587 sssd.conf.5.xml:3579
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -5204,12 +5143,12 @@ msgstr ""
 "назначать три разных стиля записи имён пользователей:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599 sssd.conf.5.xml:3591
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "domain\\username"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602 sssd.conf.5.xml:3594
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -5218,7 +5157,7 @@ msgstr ""
 "обеспечения простой интеграции пользователей из доменов Windows."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607 sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -5234,17 +5173,17 @@ msgstr ""
 "создать собственное re_expression."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659 sssd.conf.5.xml:3651
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "По умолчанию: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665 sssd.conf.5.xml:3657
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668 sssd.conf.5.xml:3660
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -5253,46 +5192,46 @@ msgstr ""
 "следует использовать при выполнении запросов DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672 sssd.conf.5.xml:3664
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Поддерживаемые значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675 sssd.conf.5.xml:3667
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: попытаться найти адрес IPv4, в случае неудачи попытаться найти "
 "адрес IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3670
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr "ipv4_only: пытаться разрешать имена узлов только в адреса IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681 sssd.conf.5.xml:3673
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: попытаться найти адрес IPv6, в случае неудачи попытаться найти "
 "адрес IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684 sssd.conf.5.xml:3676
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr "ipv6_only: пытаться разрешать имена узлов только в адреса IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687 sssd.conf.5.xml:3679
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "По умолчанию: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693 sssd.conf.5.xml:3685
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_server_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696 sssd.conf.5.xml:3688
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
@@ -5302,7 +5241,7 @@ msgstr ""
 "следующему."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701 sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
@@ -5310,8 +5249,7 @@ msgstr ""
 "времени проверки связи CLDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
-#: sssd.conf.5.xml:3697 sssd.conf.5.xml:3717 sssd.conf.5.xml:3738
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
@@ -5320,18 +5258,17 @@ msgstr ""
 "<quote>ОБРАБОТКА ОТКАЗА</quote>."
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
-#: sssd.conf.5.xml:3702
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "По умолчанию: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716 sssd.conf.5.xml:3708
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719 sssd.conf.5.xml:3711
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
@@ -5342,13 +5279,18 @@ msgstr ""
 "записи SRV) перед попыткой перехода к следующему имени узла или поиску "
 "следующего DNS."
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "По умолчанию: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736 sssd.conf.5.xml:3728
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739 sssd.conf.5.xml:3731
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -5361,12 +5303,12 @@ msgstr ""
 "работу в автономном режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757 sssd.conf.5.xml:3749
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_use_search_list (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760 sssd.conf.5.xml:3752
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -5377,7 +5319,7 @@ msgstr ""
 "средах с неправильно настроенным DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766 sssd.conf.5.xml:3758
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -5388,17 +5330,17 @@ msgstr ""
 "запросы DNS в таких средах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772 sssd.conf.5.xml:3764
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "По умолчанию: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778 sssd.conf.5.xml:3770
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781 sssd.conf.5.xml:3773
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -5407,17 +5349,17 @@ msgstr ""
 "доменную часть запроса обнаружения служб DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785 sssd.conf.5.xml:3777
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr "По умолчанию: использовать доменную часть имени узла компьютера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791 sssd.conf.5.xml:3783
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr "failover_primary_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794 sssd.conf.5.xml:3786
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -5428,59 +5370,59 @@ msgstr ""
 "повторного подключения к основному серверу."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801 sssd.conf.5.xml:3793
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr "Примечание: минимальное значение — 31."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804 sssd.conf.5.xml:3796
+#: sssd.conf.5.xml:3777
 msgid "Default: 31"
 msgstr "По умолчанию: 31"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810 sssd.conf.5.xml:3802
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813 sssd.conf.5.xml:3805
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "Переопределить значение основного GID указанным значением."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819 sssd.conf.5.xml:3811
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826 sssd.conf.5.xml:3818
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829 sssd.conf.5.xml:3821
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 "С учётом регистра. Это значение не является корректным для поставщика данных "
 "AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835 sssd.conf.5.xml:3827
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837 sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr "Без учёта регистра."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841 sssd.conf.5.xml:3833
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844 sssd.conf.5.xml:3836
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -5492,7 +5434,7 @@ msgstr ""
 "регистр в выведенных данных."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852 sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
@@ -5502,7 +5444,7 @@ msgstr ""
 "на сервере."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822 sssd.conf.5.xml:3814
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -5511,17 +5453,17 @@ msgstr ""
 "значения: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867 sssd.conf.5.xml:3859
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr "По умолчанию: True (False для поставщика данных AD)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873 sssd.conf.5.xml:3865
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876 sssd.conf.5.xml:3868
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -5533,47 +5475,47 @@ msgstr ""
 "параметров:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882 sssd.conf.5.xml:3874
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885 sssd.conf.5.xml:3877
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888 sssd.conf.5.xml:3880
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891 sssd.conf.5.xml:3883
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr "ldap_offline_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894 sssd.conf.5.xml:3886
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897 sssd.conf.5.xml:3889
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900 sssd.conf.5.xml:3892
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903 sssd.conf.5.xml:3895
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906 sssd.conf.5.xml:3898
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
@@ -5582,57 +5524,57 @@ msgstr ""
 "ldap_krb5_keytab не задан явно)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910 sssd.conf.5.xml:3902
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913 sssd.conf.5.xml:3905
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916 sssd.conf.5.xml:3908
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919 sssd.conf.5.xml:3911
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922 sssd.conf.5.xml:3914
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401 sssd.conf.5.xml:3917
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928 sssd.conf.5.xml:3920
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931 sssd.conf.5.xml:3923
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934 sssd.conf.5.xml:3926
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr "auto_private_groups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937 sssd.conf.5.xml:3929
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr "case_sensitive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942 sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5642,28 +5584,28 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949 sssd.conf.5.xml:3941
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 "Примечание: этот параметр работает только для поставщиков данных IPA и AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956 sssd.conf.5.xml:3948
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967 sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968 sssd.conf.5.xml:3960
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "плоское (NetBIOS) имя поддомена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959 sssd.conf.5.xml:3951
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5679,7 +5621,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973 sssd.conf.5.xml:3965
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5687,29 +5629,29 @@ msgstr ""
 "<emphasis>override_homedir</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977 sssd.conf.5.xml:3969
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "По умолчанию: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982 sssd.conf.5.xml:3974
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985 sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Различные метки, сохранённые службой настройки realmd для этого домена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991 sssd.conf.5.xml:3983
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr "cached_auth_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994 sssd.conf.5.xml:3986
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5723,7 +5665,7 @@ msgstr ""
 "сетевом режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002 sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
@@ -5733,12 +5675,12 @@ msgstr ""
 "значения."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007 sssd.conf.5.xml:3999
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr "Специальное значение «0» подразумевает, что эта возможность отключена."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011 sssd.conf.5.xml:4003
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5749,12 +5691,12 @@ msgstr ""
 "обработки <quote>initgroups.</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022 sssd.conf.5.xml:4014
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr "local_auth_policy (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025 sssd.conf.5.xml:4017
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5774,7 +5716,7 @@ msgstr ""
 "и проверяются локально."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037 sssd.conf.5.xml:4029
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5794,7 +5736,7 @@ msgstr ""
 "разделены запятыми, например, <quote>enable:passkey, enable:smartcard</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5806,43 +5748,42 @@ msgstr ""
 "local_auth_policy: <quote>match</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4055
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr "local_auth_policy = match (по умолчанию)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064 sssd.conf.5.xml:4056
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr "Ключ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065 sssd.conf.5.xml:4057
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr "Смарт-карта"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189 sssd.conf.5.xml:4060
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194 sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
-#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4066 sssd.conf.5.xml:4067
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr "выключено"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074 sssd.conf.5.xml:4066
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr "LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079 sssd.conf.5.xml:4071
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5855,7 +5796,7 @@ msgstr ""
 "е., например, вместо запроса пароля будет предложено ввести PIN-код."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091 sssd.conf.5.xml:4083
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5871,7 +5812,7 @@ msgstr ""
 "local_auth_policy = only\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087 sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5883,7 +5824,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099 sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
@@ -5893,22 +5834,22 @@ msgstr ""
 "помощью смарт-карты."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104 sssd.conf.5.xml:4096
+#: sssd.conf.5.xml:4077
 msgid "Default: match"
 msgstr "По умолчанию: match"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109 sssd.conf.5.xml:4101
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr "auto_private_groups (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115 sssd.conf.5.xml:4107
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr "true"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118 sssd.conf.5.xml:4110
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
@@ -5917,7 +5858,7 @@ msgstr ""
 "UID пользователя. Номер GID в этом случае игнорируется."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122 sssd.conf.5.xml:4114
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5931,12 +5872,12 @@ msgstr ""
 "пространстве идентификаторов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131 sssd.conf.5.xml:4123
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr "false"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134 sssd.conf.5.xml:4126
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
@@ -5945,12 +5886,12 @@ msgstr ""
 "ссылаться на объект группы в базе данных LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140 sssd.conf.5.xml:4132
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr "hybrid"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143 sssd.conf.5.xml:4135
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5965,7 +5906,7 @@ msgstr ""
 "основной GID этого пользователя разрешается в этот объект группы."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156 sssd.conf.5.xml:4148
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
@@ -5974,7 +5915,7 @@ msgstr ""
 "группы; в ином случае GID просто будет невозможно разрешить."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163 sssd.conf.5.xml:4155
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5985,7 +5926,7 @@ msgstr ""
 "сохранить существующие закрытые группы пользователей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112 sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -5994,7 +5935,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175 sssd.conf.5.xml:4167
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
@@ -6004,7 +5945,7 @@ msgstr ""
 "поддоменов, которые используют автоматическое сопоставление идентификаторов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183 sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -6014,7 +5955,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189 sssd.conf.5.xml:4181
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -6026,7 +5967,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180 sssd.conf.5.xml:4172
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -6040,7 +5981,7 @@ msgstr ""
 "type=\"programlisting\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579 sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -6051,17 +5992,17 @@ msgstr ""
 "replaceable>]</quote> <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204 sssd.conf.5.xml:4196
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207 sssd.conf.5.xml:4199
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "Цель, которой пересылает данные прокси PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210 sssd.conf.5.xml:4202
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -6073,12 +6014,12 @@ msgstr ""
 "local_auth_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220 sssd.conf.5.xml:4212
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223 sssd.conf.5.xml:4215
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -6089,12 +6030,12 @@ msgstr ""
 "_nss_$(libName)_$(function), например: _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233 sssd.conf.5.xml:4225
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr "proxy_resolver_lib_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236 sssd.conf.5.xml:4228
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -6105,12 +6046,12 @@ msgstr ""
 "вид _nss_$(libName)_$(function), например: _nss_dns_gethostbyname2_r."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247 sssd.conf.5.xml:4239
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250 sssd.conf.5.xml:4242
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -6124,12 +6065,12 @@ msgstr ""
 "идентификатора в кэше в целях ускорения предоставления результатов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264 sssd.conf.5.xml:4256
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr "proxy_max_children (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267 sssd.conf.5.xml:4259
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -6141,7 +6082,7 @@ msgstr ""
 "постановки запросов в очередь."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200 sssd.conf.5.xml:4192
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -6150,12 +6091,12 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283 sssd.conf.5.xml:4275
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr "Домены приложений"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285 sssd.conf.5.xml:4277
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -6184,7 +6125,7 @@ msgstr ""
 "традиционного домена SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305 sssd.conf.5.xml:4297
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -6195,17 +6136,17 @@ msgstr ""
 "порядок поиска для домена приложений и его родственного домена POSIX."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311 sssd.conf.5.xml:4303
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr "Параметры доменов приложений"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313 sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr "inherit_from (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316 sssd.conf.5.xml:4308
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -6218,7 +6159,7 @@ msgstr ""
 "<quote>родственного</quote> домена."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330 sssd.conf.5.xml:4322
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -6233,7 +6174,7 @@ msgstr ""
 "атрибут phone доступным через интерфейс D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338 sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6267,12 +6208,12 @@ msgstr ""
 "ldap_user_extra_attrs = phone:telephoneNumber\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358 sssd.conf.5.xml:4350
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr "РАЗДЕЛ ДОВЕРЕННЫХ ДОМЕНОВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360 sssd.conf.5.xml:4352
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -6290,57 +6231,57 @@ msgstr ""
 "поддерживаются следующие параметры:"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367 sssd.conf.5.xml:4359
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr "ldap_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368 sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr "ldap_user_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369 sssd.conf.5.xml:4361
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr "ldap_group_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370 sssd.conf.5.xml:4362
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr "ldap_netgroup_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371 sssd.conf.5.xml:4363
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr "ldap_service_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372 sssd.conf.5.xml:4364
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr "ldap_sasl_mech,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373 sssd.conf.5.xml:4365
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr "ad_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374 sssd.conf.5.xml:4366
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr "ad_backup_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375 sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr "ad_site,"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884 sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr "use_fully_qualified_names"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380 sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
@@ -6349,12 +6290,12 @@ msgstr ""
 "справочной странице."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr "РАЗДЕЛ СОПОСТАВЛЕНИЯ СЕРТИФИКАТОВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388 sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -6377,7 +6318,7 @@ msgstr ""
 "проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402 sssd.conf.5.xml:4394
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -6388,7 +6329,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411 sssd.conf.5.xml:4403
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -6401,12 +6342,12 @@ msgstr ""
 "replaceable>]</quote>. В этом разделе допустимы следующие параметры:"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418 sssd.conf.5.xml:4410
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr "matchrule (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421 sssd.conf.5.xml:4413
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
@@ -6415,7 +6356,7 @@ msgstr ""
 "соответствуют этому правилу. Все остальные будут игнорироваться."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425 sssd.conf.5.xml:4417
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
@@ -6425,17 +6366,17 @@ msgstr ""
 "<quote>clientAuth</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432 sssd.conf.5.xml:4424
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr "maprule (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435 sssd.conf.5.xml:4427
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr "Определяет способ поиска пользователя для указанного сертификата."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441 sssd.conf.5.xml:4433
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
@@ -6445,7 +6386,7 @@ msgstr ""
 "quote>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447 sssd.conf.5.xml:4439
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
@@ -6454,12 +6395,12 @@ msgstr ""
 "пользователя с таким же именем."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456 sssd.conf.5.xml:4448
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr "domains (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459 sssd.conf.5.xml:4451
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -6472,17 +6413,17 @@ msgstr ""
 "параметра можно добавить правило также и в поддомены."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466 sssd.conf.5.xml:4458
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr "По умолчанию: настроенный домен в sssd.conf"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471 sssd.conf.5.xml:4463
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr "priority (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474 sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -6493,12 +6434,12 @@ msgstr ""
 "приоритет, а <quote>4294967295</quote> — самый низкий."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480 sssd.conf.5.xml:4472
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr "По умолчанию: самый низкий приоритет"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486 sssd.conf.5.xml:4478
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
@@ -6508,7 +6449,7 @@ msgstr ""
 "свойства:"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492 sssd.conf.5.xml:4484
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
@@ -6517,7 +6458,7 @@ msgstr ""
 "RULE_NAME"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498 sssd.conf.5.xml:4490
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -6530,17 +6471,17 @@ msgstr ""
 "<quote>({subject_rfc822_name.short_name})</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507 sssd.conf.5.xml:4499
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr "параметр <quote>domains</quote> игнорируется"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515 sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr "РАЗДЕЛ НАСТРОЙКИ ЗАПРОСОВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517 sssd.conf.5.xml:4509
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -6555,7 +6496,7 @@ msgstr ""
 "запросит у пользователя соответствующие учётные данные."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525 sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -6568,22 +6509,22 @@ msgstr ""
 "Следующие параметры обеспечивают более гибкую настройку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537 sssd.conf.5.xml:4529
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540 sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr "password_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541 sssd.conf.5.xml:4533
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr "изменить строку запроса пароля"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539 sssd.conf.5.xml:4531
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6592,37 +6533,37 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549 sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr "[prompting/2fa]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553 sssd.conf.5.xml:4545
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554 sssd.conf.5.xml:4546
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr "изменить строку запроса первого фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557 sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr "second_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558 sssd.conf.5.xml:4550
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr "изменить строку запроса второго фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561 sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr "single_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562 sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -6635,7 +6576,7 @@ msgstr ""
 "фактора, даже если второй фактор является необязательным."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551 sssd.conf.5.xml:4543
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -6647,18 +6588,29 @@ msgstr ""
 "необязательным и должно быть возможно выполнить вход, указав либо только "
 "пароль, либо оба фактора, следует использовать двухэтапный запрос."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579 sssd.conf.5.xml:4571
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr "[prompting/passkey]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021 sssd.conf.5.xml:4577
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr "interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587 sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -6669,22 +6621,22 @@ msgstr ""
 "тактильного переключателя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595 sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr "interactive_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597 sssd.conf.5.xml:4589
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr "изменить сообщение интерактивного запроса."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602 sssd.conf.5.xml:4594
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr "touch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604 sssd.conf.5.xml:4596
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
@@ -6693,17 +6645,17 @@ msgstr ""
 "пользователю о необходимости коснуться устройства."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610 sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr "touch_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612 sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr "изменить сообщение запроса касания."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581 sssd.conf.5.xml:4573
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -6712,7 +6664,7 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532 sssd.conf.5.xml:4524
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -6726,7 +6678,7 @@ msgstr ""
 "type=\"variablelist\" id=\"2\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623 sssd.conf.5.xml:4615
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -6737,13 +6689,12 @@ msgstr ""
 "конкретно для этой службы."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
-#: sssd.conf.5.xml:4622
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr "ПРИМЕРЫ"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636 sssd.conf.5.xml:4628
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6795,7 +6746,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632 sssd.conf.5.xml:4624
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6807,7 +6758,7 @@ msgstr ""
 "документации. <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668 sssd.conf.5.xml:4660
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6817,7 +6768,7 @@ msgstr ""
 "use_fully_qualified_names = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662 sssd.conf.5.xml:4654
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6834,7 +6785,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679 sssd.conf.5.xml:4671
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6850,7 +6801,7 @@ msgstr ""
 "priority = 10\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673 sssd.conf.5.xml:4665
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -7055,7 +7006,7 @@ msgstr ""
 "http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Примеры:"
@@ -7573,7 +7524,7 @@ msgstr ""
 "параметра <emphasis>ldap_connection_expire_offset</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "По умолчанию: 900 (15 минут)"
 
@@ -7900,7 +7851,7 @@ msgstr ""
 "сертификации, которые распознаются <command>sssd</command>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -7915,11 +7866,19 @@ msgstr "ldap_tls_cacertdir (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "Позволяет указать путь к каталогу, в котором хранятся сертификаты центра "
 "сертификации, каждый в своём файле. Обычно имена файлов — это хэш "
@@ -7927,32 +7886,32 @@ msgstr ""
 "использовать команду <command>cacertdir_rehash</command>, если она доступна."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr "Позволяет указать файл, который содержит сертификат для ключа клиента."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "Позволяет указать файл, который содержит ключ клиента."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -7964,12 +7923,12 @@ msgstr ""
 "<manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -7981,12 +7940,12 @@ msgstr ""
 "<emphasis>true</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -7998,19 +7957,19 @@ msgstr ""
 "ldap_group_gid_number."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "В настоящее время эта функциональная возможность поддерживает только "
 "сопоставление objectSID Active Directory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr "ldap_min_id, ldap_max_id (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -8030,17 +7989,17 @@ msgstr ""
 "другие диапазоны для сопоставления идентификаторов."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr "По умолчанию: не задано (оба параметра установлены в значение 0)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
@@ -8049,7 +8008,7 @@ msgstr ""
 "время протестированы и поддерживаются только GSSAPI и GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -8067,12 +8026,12 @@ msgstr ""
 "manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -8092,7 +8051,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -8112,17 +8071,17 @@ msgstr ""
 "найдены, возвращается первый участник из таблицы ключей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "По умолчанию: host/hostname@REALM"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -8133,17 +8092,17 @@ msgstr ""
 "ldap_sasl_authid также содержит область, этот параметр игнорируется."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "По умолчанию: значение krb5_realm."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -8153,36 +8112,36 @@ msgstr ""
 "привязки SASL."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "По умолчанию: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 "Позволяет указать таблицу ключей, которую следует использовать при "
 "использовании проверки подлинности с помощью SASL/GSSAPI/GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "По умолчанию: системная таблица ключей, обычно <filename>/etc/krb5.keytab</"
 "filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -8193,12 +8152,12 @@ msgstr ""
 "используется SASL и выбран механизм GSSAPI или GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
@@ -8206,17 +8165,17 @@ msgstr ""
 "GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "По умолчанию: 86400 (24 часа)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -8235,7 +8194,7 @@ msgstr ""
 "сведения доступны в разделе <quote>ОБНАРУЖЕНИЕ СЛУЖБ</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -8247,7 +8206,7 @@ msgstr ""
 "в которых в качестве протокола указан _tcp."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -8258,31 +8217,31 @@ msgstr ""
 "перейти на использование <quote>krb5_server</quote> в файлах конфигурации."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 "Позволяет указать область Kerberos (для проверки подлинности с помощью SASL/"
 "GSSAPI/GSS-SPNEGO)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 "По умолчанию: стандартные параметры системы, см. <filename>/etc/krb5.conf</"
 "filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -8292,12 +8251,12 @@ msgstr ""
 ">= 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -8312,7 +8271,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -8323,12 +8282,12 @@ msgstr ""
 "<manvolnum>8</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -8337,7 +8296,7 @@ msgstr ""
 "клиента. Допускаются следующие значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -8346,7 +8305,7 @@ msgstr ""
 "параметра нельзя отключить политики паролей на стороне сервера."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -8359,7 +8318,7 @@ msgstr ""
 "пароля. См. также опцию «ldap_chpass_update_last_change»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -8371,7 +8330,7 @@ msgstr ""
 "chpass_provider=krb5."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
@@ -8381,18 +8340,18 @@ msgstr ""
 "этого параметра."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 "Позволяет указать, следует ли включить автоматическое прослеживание ссылок."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -8401,7 +8360,7 @@ msgstr ""
 "случае, если сервис собран с OpenLDAP версии 2.4.13 или выше."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -8423,29 +8382,29 @@ msgstr ""
 "домена AD, это не позволило бы получить дополнительные данные."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "Позволяет указать имя службы, которое будет использоваться, когда включено "
 "обнаружение служб."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "По умолчанию: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -8454,17 +8413,17 @@ msgstr ""
 "менять пароль, когда включено обнаружение служб."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr "По умолчанию: не задано, то есть обнаружение служб отключено"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
@@ -8473,7 +8432,7 @@ msgstr ""
 "данными о количестве дней с момента выполнения действия по смены пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -8486,12 +8445,12 @@ msgstr ""
 "SSSD должен обновить его."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -8520,12 +8479,12 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Пример:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -8537,7 +8496,7 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
@@ -8546,7 +8505,7 @@ msgstr ""
 "атрибут employeeType которых установлен в значение «admin»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -8561,17 +8520,17 @@ msgstr ""
 "в автономном режиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "По умолчанию: пусто"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -8580,7 +8539,7 @@ msgstr ""
 "доступом на стороне клиента."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -8591,12 +8550,12 @@ msgstr ""
 "соответствующим кодом ошибки, даже если пароль верен."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Допускаются следующие значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -8605,7 +8564,7 @@ msgstr ""
 "для определения того, не истёк ли срок действия учётной записи."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -8618,7 +8577,7 @@ msgstr ""
 "не истёк ли срок действия учётной записи."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -8629,7 +8588,7 @@ msgstr ""
 "разрешён ли доступ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -8642,7 +8601,7 @@ msgstr ""
 "Если все атрибуты отсутствуют, доступ предоставляется."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -8653,24 +8612,24 @@ msgstr ""
 "использовать параметр ldap_account_expire_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "Разделённый запятыми список параметров управления доступом. Допустимые "
 "значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis>: использовать ldap_access_filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8686,7 +8645,7 @@ msgstr ""
 "«access_provider = ldap»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
@@ -8696,7 +8655,7 @@ msgstr ""
 "следующей версии.  </emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8719,12 +8678,12 @@ msgstr ""
 "возможности необходимо задать «access_provider = ldap»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>expire</emphasis>: использовать ldap_account_expire_policy"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -8738,7 +8697,7 @@ msgstr ""
 "и для проверки подлинности используются не пароли, а, например, ключи SSH."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
@@ -8747,18 +8706,18 @@ msgstr ""
 "предпринимаются, если срок действия пароля пользователя истёк:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr "pwd_expire_policy_reject — пользователю отказано во входе в систему,"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 "pwd_expire_policy_warn — пользователь по-прежнему может войти в систему,"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
@@ -8767,17 +8726,23 @@ msgstr ""
 "свой пароль."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
+#, fuzzy
+#| msgid ""
+#| "Please note that 'access_provider = ldap' must be set for this feature to "
+#| "work. Also 'ldap_pwd_policy' must be set to an appropriate password "
+#| "policy."
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 "Следует учитывать, что для работы этой возможности необходимо указать "
 "«access_provider = ldap». Также необходимо указать соответствующую политику "
 "паролей в качестве значения параметра «ldap_pwd_policy»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -8786,14 +8751,14 @@ msgstr ""
 "authorizedService для определения возможности доступа"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis>: использовать атрибут host для определения "
 "возможности доступа"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
@@ -8802,7 +8767,7 @@ msgstr ""
 "возможности доступа удалённого узла"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
@@ -8812,12 +8777,12 @@ msgstr ""
 "прежде чем включать этот параметр управления доступом"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "По умолчанию: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -8826,12 +8791,12 @@ msgstr ""
 "ошибкой конфигурации."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr "ldap_pwdlockout_dn (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -8844,22 +8809,22 @@ msgstr ""
 "невозможности надлежащим образом проверить атрибуты ppolicy на сервере LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr "Пример: cn=ppolicy,ou=policies,dc=example,dc=com"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr "По умолчанию: cn=ppolicy,ou=policies,$ldap_search_base"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -8868,12 +8833,12 @@ msgstr ""
 "выполнении поиска. Допустимые варианты:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr "<emphasis>never</emphasis>: разыменование псевдонимов не выполняется."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -8883,7 +8848,7 @@ msgstr ""
 "объекта поиска."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -8892,7 +8857,7 @@ msgstr ""
 "при определении расположения базового объекта поиска."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -8901,7 +8866,7 @@ msgstr ""
 "поиске, так и при определении расположения базового объекта поиска."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -8910,12 +8875,12 @@ msgstr ""
 "клиентскими библиотеками LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -8924,7 +8889,7 @@ msgstr ""
 "серверов, которые используют схему RFC2307."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -8941,7 +8906,7 @@ msgstr ""
 "информацию о пользователе через вызовы getpw*() или initgroups()."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -8953,12 +8918,12 @@ msgstr ""
 "группами LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr "wildcard_limit (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
@@ -8967,24 +8932,24 @@ msgstr ""
 "поиска с использованием подстановочных знаков."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 "В настоящее время только ответчик InfoPipe поддерживает поиск с "
 "использованием подстановочных знаков."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr "По умолчанию: 1000 (часто размер одной страницы)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr "ldap_library_debug_level (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
@@ -8993,7 +8958,7 @@ msgstr ""
 "записываются независимо от общего debug_level."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
@@ -9002,17 +8967,17 @@ msgstr ""
 "компонентов, -1 включает полный отладочный вывод."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "По умолчанию: 0 (отладка libldap отключена)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_use_ppolicy (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
@@ -9022,6 +8987,24 @@ msgstr ""
 "стороне сервера. Отключение этого параметра позволяет взаимодействовать со "
 "службами, отправляющими обратно недопустимое расширение ppolicy."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (целое число)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -9043,12 +9026,12 @@ msgstr ""
 "</citerefentry>. <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "ПАРАМЕТРЫ SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -9059,12 +9042,12 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
@@ -9073,7 +9056,7 @@ msgstr ""
 "загружаются все правила, которые хранятся на сервере)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -9082,7 +9065,7 @@ msgstr ""
 "<emphasis>ldap_sudo_smart_refresh_interval </emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
@@ -9091,17 +9074,17 @@ msgstr ""
 "Но должно быть включено либо интеллектуальное, либо полное обновление."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "По умолчанию: 21600 (6 часов)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -9113,7 +9096,7 @@ msgstr ""
 "в настоящее время известно SSSD)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
@@ -9122,7 +9105,7 @@ msgstr ""
 "modifyTimestamp."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -9138,7 +9121,7 @@ msgstr ""
 "<emphasis>ldap_connection_expire_timeout</emphasis>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
@@ -9148,12 +9131,12 @@ msgstr ""
 "обновление."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_sudo_random_offset (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -9164,7 +9147,7 @@ msgstr ""
 "периодического задания. Значение указывается в секундах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -9175,17 +9158,17 @@ msgstr ""
 "время, в течение которого правила sudo недоступны для использования."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr "Можно отключить эту задержку, установив значение «0»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
@@ -9195,12 +9178,12 @@ msgstr ""
 "адресов узлов/сетей в формате IPv4 или IPv6)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -9209,7 +9192,7 @@ msgstr ""
 "следует использовать для фильтрации правил."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
@@ -9218,8 +9201,8 @@ msgstr ""
 "обнаружить имя узла и полное доменное имя."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -9228,17 +9211,17 @@ msgstr ""
 "<emphasis>false</emphasis>, этот параметр ни на что не влияет."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "По умолчанию: не указано"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -9247,7 +9230,7 @@ msgstr ""
 "следует использовать для фильтрации правил."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -9256,12 +9239,12 @@ msgstr ""
 "обнаружить адреса."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
@@ -9270,12 +9253,12 @@ msgstr ""
 "правила, которые содержат сетевую группу в атрибуте sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
@@ -9284,7 +9267,7 @@ msgstr ""
 "правила, которые содержат подстановочный знак в атрибуте sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
@@ -9293,7 +9276,7 @@ msgstr ""
 "операция на стороне сервера LDAP!"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -9306,12 +9289,12 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "ПАРАМЕТРЫ AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
@@ -9320,47 +9303,47 @@ msgstr ""
 "схемы LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "Имя основной карты автоматического монтирования в LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "По умолчанию: auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "ДОПОЛНИТЕЛЬНЫЕ ПАРАМЕТРЫ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr "<note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -9373,22 +9356,22 @@ msgstr ""
 "эту возможность, если имена групп отображаются некорректно."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr "</note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -9401,14 +9384,14 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "ПРИМЕР"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -9419,7 +9402,7 @@ msgstr ""
 "<replaceable>[domains]</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9439,20 +9422,20 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr "ПРИМЕР ФИЛЬТРА ДОСТУПА LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
@@ -9461,7 +9444,7 @@ msgstr ""
 "используется ldap_access_order=lockout."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9487,13 +9470,13 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "ПРИМЕЧАНИЯ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -12324,7 +12307,7 @@ msgstr ""
 "домене IPA. Имя узла должно быть полным."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (логическое значение)"
 
@@ -12344,7 +12327,7 @@ msgstr ""
 "<quote>dyndns_iface</quote> не указано иное."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -12366,12 +12349,12 @@ msgstr ""
 "конфигурации."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -12400,12 +12383,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "По умолчанию: 1200 (секунд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -12440,17 +12423,17 @@ msgstr ""
 "подключения LDAP IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr "Пример: dyndns_iface = em1, vnet1, vnet2"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr "dyndns_auth (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -12461,17 +12444,17 @@ msgstr ""
 "отправлять, установив этот параметр в значение «none»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr "По умолчанию: GSS-TSIG"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_auth_ptr (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -12482,7 +12465,7 @@ msgstr ""
 "отправлять, установив этот параметр в значение «none»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr "По умолчанию: то же, что и dyndns_auth"
 
@@ -12518,7 +12501,7 @@ msgstr ""
 "использоваться в качестве резервных"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (целое число)"
 
@@ -12536,12 +12519,12 @@ msgstr ""
 "«true»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -12561,7 +12544,7 @@ msgstr ""
 "автоматически при смене записей перенаправления."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -12576,12 +12559,12 @@ msgid "Default: False (disabled)"
 msgstr "По умолчанию: false (отключено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -12590,17 +12573,17 @@ msgstr ""
 "с сервером DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "По умолчанию: false (разрешить nsupdate выбрать протокол)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr "dyndns_server (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
@@ -12610,7 +12593,7 @@ msgstr ""
 "параметра."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
@@ -12619,7 +12602,7 @@ msgstr ""
 "отличается от сервера данных идентификации."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
@@ -12629,17 +12612,17 @@ msgstr ""
 "использованием автоматически определённых параметров завершилась неудачей."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr "По умолчанию: none (разрешить nsupdate выбрать сервер)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr "dyndns_update_per_family (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -12813,12 +12796,12 @@ msgstr ""
 "DN, которое следует использовать для выполнения действий LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr "krb5_confd_path (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
@@ -12827,7 +12810,7 @@ msgstr ""
 "конфигурации Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
@@ -12836,7 +12819,7 @@ msgstr ""
 "значение «none»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -12859,7 +12842,7 @@ msgstr ""
 "короткое время поступает много запросов на профили рабочего стола."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "По умолчанию: 5 (секунд)"
 
@@ -13768,19 +13751,16 @@ msgstr "ad_access_filter (строка)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
-"Этот параметр позволяет указать фильтр управления доступом LDAP, условиям "
-"которого должен соответствовать пользователь для получения доступа. Обратите "
-"внимание, что этот параметр будет работать только в том случае, если "
-"параметр <quote>access_provider</quote> явно установлен в значение "
-"<quote>ad</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -13793,7 +13773,7 @@ msgstr ""
 "quote> или <quote>FOREST</quote>, а также оно может отсутствовать."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -13807,7 +13787,7 @@ msgstr ""
 "указанного значением <quote>NAME</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
@@ -13816,7 +13796,7 @@ msgstr ""
 "аналогично работе баз поиска."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -13838,7 +13818,7 @@ msgstr ""
 "посвящённом расширениям LDAP</ulink>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -13852,7 +13832,7 @@ msgstr ""
 "будет использоваться первое из них."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -13882,12 +13862,12 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr "ad_site (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
@@ -13897,12 +13877,12 @@ msgstr ""
 "выполнено автоматически."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -13916,7 +13896,7 @@ msgstr ""
 "текущего сервера AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -13930,12 +13910,12 @@ msgstr ""
 "каталог."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -13950,7 +13930,7 @@ msgstr ""
 "<quote>ad</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -13963,7 +13943,7 @@ msgstr ""
 "параметрах политики доступны в описании параметров <quote>ad_gpo_map</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -13977,7 +13957,7 @@ msgstr ""
 "com/SSSD/sssd/issues/5063 ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -13992,7 +13972,7 @@ msgstr ""
 "должна обладать следующими правами GPO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
@@ -14001,7 +13981,7 @@ msgstr ""
 "свойств GPO (RIGHT_DS_READ_PROPERTY)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
@@ -14010,7 +13990,7 @@ msgstr ""
 "разрешено применять GPO (RIGHT_DS_CONTROL_ACCESS)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -14026,7 +14006,7 @@ msgstr ""
 "Users GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -14054,12 +14034,12 @@ msgstr ""
 "citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr "Для этого параметра поддерживаются три значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
@@ -14067,14 +14047,14 @@ msgstr ""
 "доступом на основе GPO, ни их принудительное применение."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 "enforcing: осуществляется проверка соответствия правилам управления доступом "
 "на основе GPO и их принудительное применение."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -14087,22 +14067,22 @@ msgstr ""
 "принудительный режим."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "По умолчанию: permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr "По умолчанию: enforcing"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr "ad_gpo_implicit_deny (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -14120,7 +14100,7 @@ msgstr ""
 "встроенной группе Administrators, если к ним не применяются правила GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -14132,77 +14112,77 @@ msgstr ""
 "ad_gpo_implicit_deny."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr "ad_gpo_implicit_deny = False (по умолчанию)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr "правила разрешения"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr "правила запрета"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr "результат"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr "отсутствуют"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr "доступ разрешён всем пользователям"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr "присутствуют"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr "доступ разрешён только пользователям, отсутствующим в правилах запрета"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 "доступ разрешён только пользователям, присутствующим в правилах разрешения"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 "доступ разрешён только пользователям, присутствующим в правилах разрешения и "
 "отсутствующим в правилах запрета"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr "ad_gpo_implicit_deny = True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr "доступ запрещён всем пользователям"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr "ad_gpo_ignore_unreadable (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -14217,12 +14197,12 @@ msgstr ""
 "групповой политики недоступны для чтения SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr "ad_gpo_cache_timeout (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -14233,12 +14213,12 @@ msgstr ""
 "поступает много запросов на управление доступом."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr "ad_gpo_map_interactive (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -14267,7 +14247,7 @@ msgstr ""
 "являются частью параметров политики."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
@@ -14277,7 +14257,7 @@ msgstr ""
 "локальный вход» («Deny log on locally»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -14287,7 +14267,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14306,42 +14286,42 @@ msgstr ""
 "конфигурацию: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr "gdm-fingerprint"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr "lightdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr "lxdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr "sddm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr "unity"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr "xdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr "ad_gpo_map_remote_interactive (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -14370,7 +14350,7 @@ msgstr ""
 "если он или хотя бы одна из его групп являются частью параметров политики."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -14382,7 +14362,7 @@ msgstr ""
 "удалённых рабочих столов» («Deny log on through Remote Desktop Services»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -14392,7 +14372,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14411,22 +14391,22 @@ msgstr ""
 "конфигурацию: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr "sshd"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr "cockpit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr "ad_gpo_map_network (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -14455,7 +14435,7 @@ msgstr ""
 "политики."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -14467,7 +14447,7 @@ msgstr ""
 "to this computer from the network»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -14477,7 +14457,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14496,22 +14476,22 @@ msgstr ""
 "конфигурацию: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr "ftp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr "samba"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr "ad_gpo_map_batch (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -14539,7 +14519,7 @@ msgstr ""
 "политики."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
@@ -14550,7 +14530,7 @@ msgstr ""
 "a batch job»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -14560,7 +14540,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14579,7 +14559,7 @@ msgstr ""
 "конфигурацию: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
@@ -14587,17 +14567,17 @@ msgstr ""
 "дистрибутива Linux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr "crond"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr "ad_gpo_map_service (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -14626,7 +14606,7 @@ msgstr ""
 "политики."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
@@ -14636,7 +14616,7 @@ msgstr ""
 "и «Запретить вход в качестве службы» («Deny log on as a service»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -14646,7 +14626,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -14663,12 +14643,12 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr "ad_gpo_map_permit (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
@@ -14677,7 +14657,7 @@ msgstr ""
 "доступ на основе GPO, независимо от прав входа GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -14687,7 +14667,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14706,22 +14686,22 @@ msgstr ""
 "конфигурацию: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr "polkit-1"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr "systemd-user"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr "ad_gpo_map_deny (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
@@ -14730,7 +14710,7 @@ msgstr ""
 "доступ на основе GPO, независимо от прав входа GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -14740,12 +14720,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr "ad_gpo_default_right (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -14767,52 +14747,52 @@ msgstr ""
 "доступ для несопоставленных имён служб PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr "Для этого параметра поддерживаются следующие значения:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr "remote_interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr "network"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr "batch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr "service"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr "permit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr "deny"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr "По умолчанию: deny"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr "ad_maximum_machine_account_password_age (целое число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -14823,17 +14803,17 @@ msgstr ""
 "его. Значение «0» отключает попытку обновления."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr "По умолчанию: 30 дней"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr "ad_machine_account_password_renewal_opts (строка)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -14849,17 +14829,17 @@ msgstr ""
 "после перезапуска."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr "По умолчанию: 86400:750 (24 часа и 15 минут)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr "ad_update_samba_machine_account_password (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -14872,12 +14852,12 @@ msgstr ""
 "когда программа настроена на использование AD для проверки подлинности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr "ad_use_ldaps (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -14895,12 +14875,12 @@ msgstr ""
 "подключений будет установлено в значение «0» (ноль)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ad_allow_remote_domain_local_groups (логическое значение)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -14918,7 +14898,7 @@ msgstr ""
 "клиенте Linux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -14943,7 +14923,7 @@ msgstr ""
 "отсутствуют удалённые группы, локальные в домене."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -14965,7 +14945,7 @@ msgstr ""
 "вложенности."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -14982,12 +14962,12 @@ msgstr ""
 "помощью параметра <quote>dyndns_iface</quote> не указано иное."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "По умолчанию: 3600 (секунд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
@@ -14996,7 +14976,7 @@ msgstr ""
 "подключения LDAP AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -15013,7 +14993,7 @@ msgstr ""
 "допустимое значение (60 секунд)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -15024,7 +15004,7 @@ msgstr ""
 "примере показаны только параметры, относящиеся к поставщику данных AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -15048,7 +15028,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -15060,7 +15040,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -15071,7 +15051,7 @@ msgstr ""
 "данных LDAP: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -15086,7 +15066,7 @@ msgstr ""
 "параметры подключения, такие как URI LDAP и параметры шифрования."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -15719,60 +15699,73 @@ msgstr ""
 "при тестировании. Сигнал можно отправить либо процессу sssd, либо напрямую "
 "любому процессу sssd_be."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr "СОСТОЯНИЕ ВЫХОДА"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr "0"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr "SSSD был выключен корректно."
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr "Неверная конфигурация или параметр командной строки."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr "2"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr "Ошибка выделения памяти."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr "6"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr "SSSD уже запущен."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr "Другие коды"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
@@ -15782,7 +15775,7 @@ msgstr ""
 "SSSD и системных журналах."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
@@ -15791,7 +15784,7 @@ msgstr ""
 "клиентские приложения не будут использовать быстрый кэш в памяти."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -18092,9 +18085,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
 #: sss_ssh_knownhosts.1.xml:47
-#, no-wrap
+#, fuzzy, no-wrap
+#| msgid ""
+#| "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+#| "            "
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
@@ -18113,8 +18109,8 @@ msgstr ""
 "<citerefentry><refentrytitle>ssh</refentrytitle> <manvolnum>1</manvolnum></"
 "citerefentry> можно настроить на использование <command>sss_ssh_knownhosts</"
 "command> для проверки подлинности узла по открытым ключам с использованием "
-"параметра <quote>KnownHostsCommand</quote>: <placeholder type="
-"\"programlisting\" id=\"0\"/> Дополнительные сведения об этом параметре "
+"параметра <quote>KnownHostsCommand</quote>: <placeholder "
+"type=\"programlisting\" id=\"0\"/> Дополнительные сведения об этом параметре "
 "доступны на справочной странице <citerefentry> <refentrytitle>ssh_config</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry>."
 
@@ -18125,8 +18121,59 @@ msgid ""
 msgstr ""
 "Искать открытые ключи узла в домене SSSD <replaceable>DOMAIN</replaceable>."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-H</option>,<option>--ssh-hosts</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-H</option>,<option>--ssh-hosts</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -22576,6 +22623,45 @@ msgstr ""
 
 #. type: Content of: <refsect1><para>
 #: include/seealso.xml:4
+#, fuzzy
+#| msgid ""
+#| "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</"
+#| "manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-attributes</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-simple</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ad</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
+#| "condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-"
+#| "files</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+#| "<phrase condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+#| "<citerefentry> <refentrytitle>sssd-session-recording</refentrytitle> "
+#| "<manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_cache</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sss_debuglevel</"
+#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_obfuscate</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sss_seed</"
+#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle><manvolnum>8</"
+#| "manvolnum> </citerefentry>, <phrase condition=\"with_ssh\"> "
+#| "<citerefentry> <refentrytitle>sss_ssh_authorizedkeys</refentrytitle> "
+#| "<manvolnum>1</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</"
+#| "manvolnum> </citerefentry>, </phrase> <phrase condition=\"with_ifp\"> "
+#| "<citerefentry> <refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</"
+#| "manvolnum> </citerefentry>, </phrase> <citerefentry> "
+#| "<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> <phrase "
+#| "condition=\"with_stap\"> <citerefentry> <refentrytitle>sssd-systemtap</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> </phrase>"
 msgid ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
 "citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
@@ -22606,14 +22692,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
 "citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
@@ -23310,22 +23395,40 @@ msgstr ""
 "узла и участника-пользователя. Эта возможность доступна в MIT Kerberos 1.7 и "
 "выше."
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
-msgid ""
-"If a Certificate Revocation List (CRL)  is expired ignore the CRL checks for "
-"the related certificates. This option should be used to allow authentication "
-"when the system is offline and the CRL cannot be renewed."
-msgstr ""
-"Если срок действия списка отзыва сертификатов (CRL) истёк, игнорировать "
-"проверки CRL для соответствующих сертификатов. Этот параметр следует "
-"использовать, чтобы разрешить проверку подлинности, когда система находится "
-"в автономном режиме и нельзя обновить CRL."
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (целое число)"
 
-#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2684
-msgid "Feature is only supported for domains with id_provider = ldap."
-msgstr "Функция поддерживается только для доменов с id_provider = ldap."
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Количество попыток восстановления подключения службами в случае сбоя или "
+#~ "перезапуска поставщика данных"
+
+#~ msgid ""
+#~ "This option specifies LDAP access control filter that the user must match "
+#~ "in order to be allowed access. Please note that the "
+#~ "<quote>access_provider</quote> option must be explicitly set to "
+#~ "<quote>ad</quote> in order for this option to have an effect."
+#~ msgstr ""
+#~ "Этот параметр позволяет указать фильтр управления доступом LDAP, условиям "
+#~ "которого должен соответствовать пользователь для получения доступа. "
+#~ "Обратите внимание, что этот параметр будет работать только в том случае, "
+#~ "если параметр <quote>access_provider</quote> явно установлен в значение "
+#~ "<quote>ad</quote>."
+
+#~ msgid ""
+#~ "If a Certificate Revocation List (CRL)  is expired ignore the CRL checks "
+#~ "for the related certificates. This option should be used to allow "
+#~ "authentication when the system is offline and the CRL cannot be renewed."
+#~ msgstr ""
+#~ "Если срок действия списка отзыва сертификатов (CRL) истёк, игнорировать "
+#~ "проверки CRL для соответствующих сертификатов. Этот параметр следует "
+#~ "использовать, чтобы разрешить проверку подлинности, когда система "
+#~ "находится в автономном режиме и нельзя обновить CRL."
+
+#~ msgid "Feature is only supported for domains with id_provider = ldap."
+#~ msgstr "Функция поддерживается только для доменов с id_provider = ldap."
 
 #~ msgid ""
 #~ "<filename>sssd.conf</filename> must be a regular file that is owned, "
diff --git a/src/man/po/sssd-docs.pot b/src/man/po/sssd-docs.pot
index 91a689695be..c6efa998811 100644
--- a/src/man/po/sssd-docs.pot
+++ b/src/man/po/sssd-docs.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: sssd-docs 2.10.0~beta1\n"
+"Project-Id-Version: sssd-docs 2.10.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -207,13 +207,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr ""
 
@@ -230,11 +230,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -267,8 +267,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -298,8 +298,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -335,46 +335,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, "
+"sudo</phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr ""
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -385,19 +366,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -405,12 +386,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> "
 "<manvolnum>3</manvolnum> </citerefentry>-compatible format that describes "
@@ -419,70 +400,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -490,7 +471,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -498,52 +479,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at "
 "build-time. (__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -551,14 +532,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -568,17 +549,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -588,7 +569,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log "
@@ -602,8 +583,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -611,12 +592,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -626,7 +607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -635,22 +616,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -658,12 +639,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -671,61 +652,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -733,12 +714,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -746,24 +727,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -772,12 +753,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired "
@@ -786,7 +767,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -794,58 +775,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -856,7 +837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -874,18 +855,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -893,12 +874,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -906,24 +887,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -931,7 +912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -950,12 +931,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -964,22 +945,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -989,17 +970,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1009,17 +990,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1030,14 +1011,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + "
 "random[0...offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1045,44 +1026,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1091,58 +1072,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1154,59 +1135,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) "
 "service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1214,7 +1195,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1224,7 +1205,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1233,17 +1214,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1251,17 +1232,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1269,17 +1250,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1288,7 +1269,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1297,39 +1278,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1337,23 +1318,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1361,46 +1342,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in "
 "<quote>/etc/shells</quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in "
 "<quote>/etc/shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1408,56 +1389,56 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the "
 "machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during "
 "lookup. This option can be specified globally in the [nss] section or "
@@ -1465,58 +1446,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd "
@@ -1524,25 +1505,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1550,19 +1531,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1570,12 +1551,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1584,12 +1565,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1601,43 +1582,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), "
@@ -1646,60 +1627,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1707,59 +1688,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during "
 "authentication. The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1768,51 +1749,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1823,22 +1804,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1846,7 +1827,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a "
@@ -1856,17 +1837,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1874,7 +1855,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be "
@@ -1882,24 +1863,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting "
 "<emphasis>pwd_expiration_warning</emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1909,74 +1891,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1984,19 +1966,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2004,46 +1986,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2051,34 +2033,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2088,7 +2070,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2096,58 +2078,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2155,7 +2137,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2167,63 +2149,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2231,12 +2213,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2247,7 +2229,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2255,7 +2237,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = "
@@ -2264,7 +2246,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2273,46 +2255,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2321,31 +2303,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> "
 "(dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2353,7 +2335,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2361,22 +2343,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2384,19 +2366,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2404,7 +2386,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2419,7 +2401,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to "
 "<quote>-</quote> (dash). To disable the check for a specific PAM service, "
@@ -2427,45 +2409,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2473,7 +2455,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2481,17 +2463,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> "
@@ -2503,24 +2485,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2531,22 +2513,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2554,51 +2536,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2608,12 +2590,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2623,7 +2605,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2631,7 +2613,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2640,38 +2622,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2682,7 +2664,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2693,24 +2675,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2718,19 +2700,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2739,7 +2721,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2748,24 +2730,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2776,24 +2758,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2801,24 +2783,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2830,7 +2812,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2841,60 +2823,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> "
@@ -2905,66 +2887,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording "
 "enabled. Matches user names as returned by NSS. I.e. after the possible "
@@ -2972,17 +2954,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -2990,7 +2972,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -2999,57 +2981,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3059,12 +3041,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3073,14 +3055,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3089,38 +3071,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For "
@@ -3129,24 +3111,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3155,36 +3137,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3198,14 +3180,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3214,14 +3196,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3229,32 +3211,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3263,19 +3245,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3286,139 +3268,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3427,17 +3409,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3449,18 +3431,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3471,7 +3453,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3480,12 +3462,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3493,19 +3475,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3514,17 +3496,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3533,29 +3515,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> "
 "<refentrytitle>sssd-files</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3564,7 +3546,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3572,8 +3554,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> "
@@ -3582,8 +3564,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3591,19 +3573,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified "
 "names. For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3612,7 +3594,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3620,24 +3602,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3649,7 +3631,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3657,30 +3639,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3688,7 +3670,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3696,29 +3678,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3726,19 +3708,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> "
@@ -3747,7 +3729,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> "
@@ -3756,29 +3738,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> "
@@ -3787,7 +3769,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3795,34 +3777,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3830,32 +3812,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3866,7 +3848,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3875,12 +3857,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3888,7 +3870,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> "
@@ -3897,31 +3879,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> "
@@ -3930,7 +3912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3939,17 +3921,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3957,34 +3939,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> "
@@ -3992,7 +3974,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> "
@@ -4000,7 +3982,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> "
@@ -4008,24 +3990,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> "
@@ -4034,31 +4016,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> "
@@ -4067,7 +4049,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4076,12 +4058,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4091,7 +4073,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: "
 "<quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;[^@]+))$</quote> "
@@ -4099,17 +4081,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: "
 "<quote>^(((?P&lt;domain&gt;[^\\\\]+)\\\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;name&gt;[^@\\\\]+)))$</quote> "
@@ -4117,19 +4099,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4139,101 +4121,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is "
@@ -4242,12 +4229,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4255,7 +4242,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4263,34 +4250,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup "
 "server. This option defines the number of seconds SSSD waits before "
@@ -4298,57 +4285,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 msgid "Default: 31"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4356,31 +4343,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4388,104 +4375,104 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4493,27 +4480,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4523,32 +4510,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4557,19 +4544,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4577,12 +4564,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4594,7 +4581,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, "
 "enable. <quote>match</quote> is used to match offline and online states for "
@@ -4606,7 +4593,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4614,42 +4601,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4658,7 +4645,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4669,7 +4656,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4677,36 +4664,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 msgid "Default: match"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4715,24 +4702,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4742,14 +4729,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4757,21 +4744,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4779,7 +4766,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4788,7 +4775,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4797,7 +4784,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called "
@@ -4806,17 +4793,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4824,12 +4811,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4837,12 +4824,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4850,12 +4837,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4864,12 +4851,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4877,19 +4864,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> "
 "<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> "
@@ -4907,7 +4894,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4915,17 +4902,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4934,7 +4921,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4944,7 +4931,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -4964,12 +4951,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called "
@@ -4980,69 +4967,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5056,7 +5043,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5064,7 +5051,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like "
@@ -5073,55 +5060,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5130,17 +5117,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5148,26 +5135,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like "
@@ -5176,17 +5163,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file "
 "(<filename>/var/lib/sss/pubconf/pam_preauth_available</filename>)  exists "
@@ -5196,7 +5183,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5205,59 +5192,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5266,7 +5253,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5274,18 +5261,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM "
+"modules. Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5293,46 +5291,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5341,7 +5339,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, "
 "e.g. <quote>[prompting/password/sshd]</quote> to individual change the "
@@ -5349,12 +5347,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5383,7 +5381,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5392,7 +5390,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5400,7 +5398,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5411,7 +5409,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5422,7 +5420,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5585,7 +5583,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -5997,7 +5995,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6251,7 +6249,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in "
 "<filename>/etc/openldap/ldap.conf</filename>"
@@ -6268,36 +6266,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6305,12 +6304,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  "
@@ -6318,12 +6317,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6331,17 +6330,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6352,24 +6351,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6380,12 +6379,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6398,7 +6397,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6410,17 +6409,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6428,49 +6427,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6478,29 +6477,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is "
 "used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of "
@@ -6512,7 +6511,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6520,7 +6519,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of "
 "SSSD. While the legacy name is recognized for the time being, users are "
@@ -6529,39 +6528,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6571,7 +6570,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> "
 "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle> "
@@ -6580,26 +6579,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client "
 "side. The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use "
 "<citerefentry><refentrytitle>shadow</refentrytitle> "
@@ -6609,7 +6608,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6617,31 +6616,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6654,51 +6653,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6707,12 +6706,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6729,12 +6728,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6743,14 +6742,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6759,24 +6758,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6784,19 +6783,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6805,7 +6804,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, "
 "<emphasis>389ds</emphasis>: use the value of ldap_ns_account_lock to check "
@@ -6813,7 +6812,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6822,7 +6821,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option "
 "<emphasis>must</emphasis> include <quote>expire</quote> in order for the "
@@ -6830,22 +6829,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6855,7 +6854,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the "
 "<quote>ppolicy</quote> option and might be removed in a future release.  "
@@ -6863,7 +6862,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6876,12 +6875,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6891,57 +6890,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control "
@@ -6949,24 +6949,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -6975,74 +6975,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7053,7 +7053,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7061,64 +7061,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy "
 "controls. Disabling this allows interacting with services which send back "
 "invalid ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7132,12 +7148,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7145,43 +7161,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval "
 "</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7189,14 +7205,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7206,19 +7222,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7226,7 +7242,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7234,106 +7250,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is "
 "<emphasis>false</emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7342,59 +7358,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7403,22 +7419,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7427,14 +7443,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7442,7 +7458,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7455,27 +7471,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7491,13 +7507,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9742,7 +9758,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9757,7 +9773,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9772,12 +9788,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9798,12 +9814,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9827,17 +9843,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9845,17 +9861,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9863,7 +9879,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9891,7 +9907,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9904,12 +9920,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9923,7 +9939,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9935,60 +9951,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10136,26 +10152,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
 
@@ -10173,7 +10189,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10889,14 +10905,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the "
-"<quote>access_provider</quote> option must be explicitly set to "
-"<quote>ad</quote> in order for this option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option "
+"<quote>ad_gpo_access_control</quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or "
 "forest. This extended filter would consist of: "
@@ -10905,7 +10923,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then "
 "<quote>NAME</quote> specifies the domain or subdomain the filter applies "
@@ -10914,14 +10932,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full "
@@ -10934,7 +10952,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the "
@@ -10943,7 +10961,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10961,24 +10979,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -10987,7 +11005,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -10996,12 +11014,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -11011,7 +11029,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11020,7 +11038,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11029,7 +11047,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11039,21 +11057,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11063,7 +11081,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11079,22 +11097,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11102,22 +11120,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed "
 "access. When this option is set to True users will be allowed access only "
@@ -11128,7 +11146,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11136,74 +11154,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11213,12 +11231,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11226,12 +11244,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11247,14 +11265,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11262,7 +11280,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11274,42 +11292,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11325,7 +11343,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11333,7 +11351,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11341,7 +11359,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11353,22 +11371,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11384,7 +11402,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11392,7 +11410,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11400,7 +11418,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11412,22 +11430,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11442,14 +11460,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11457,7 +11475,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11469,22 +11487,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11500,14 +11518,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11515,7 +11533,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11526,19 +11544,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11546,7 +11564,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11558,29 +11576,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11588,12 +11606,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11606,52 +11624,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11659,17 +11677,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal "
 "task. The option expects 2 integers separated by a colon (':'). The first "
@@ -11679,17 +11697,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11698,12 +11716,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11714,12 +11732,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11730,7 +11748,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11745,7 +11763,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting "
@@ -11758,7 +11776,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11769,19 +11787,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11791,7 +11809,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and "
 "example.com is one of the domains in the <replaceable>[sssd]</replaceable> "
@@ -11799,7 +11817,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11814,7 +11832,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11823,7 +11841,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11831,7 +11849,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11841,7 +11859,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12324,74 +12342,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14203,7 +14234,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14226,8 +14257,58 @@ msgid ""
 "<replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> "
+"<manvolnum>8</manvolnum></citerefentry>. However, returning only the keytype "
+"and the key itself is tolerated, in which case, the hostname received as "
+"parameter will be added before the keytype to output a correctly formatted "
+"line. The hostname will be added unmodified or just the hostname (no port "
+"number), depending on whether the "
+"<option>-o</option>,<option>--only-host-name</option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; "
+"&lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17908,9 +17989,9 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> "
 "<manvolnum>1</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> "
 "</citerefentry>, </phrase> <citerefentry> "
+"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> "
+"</citerefentry>, <citerefentry> "
 "<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> "
 "</citerefentry>.  <citerefentry> "
 "<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> "
diff --git a/src/man/po/sv.po b/src/man/po/sv.po
index 6bc9e1c1a45..fc288f200e5 100644
--- a/src/man/po/sv.po
+++ b/src/man/po/sv.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2024-09-02 11:38+0000\n"
 "Last-Translator: Göran Uddeborg <goeran@uddeborg.se>\n"
 "Language-Team: Swedish <https://translate.fedoraproject.org/projects/sssd/"
@@ -249,13 +249,13 @@ msgstr ""
 "aktiverat för SSSD-felsökningsloggning ignoreras denna flagga."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Standard: true"
 
@@ -274,11 +274,11 @@ msgstr ""
 "journald är aktiverat för SSSD-felsökningsloggning ignoreras denna flagga."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Standard: false"
@@ -318,8 +318,8 @@ msgstr ""
 "ingen effekt för andra loggningstyper)."
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -352,8 +352,8 @@ msgstr ""
 "att efter tre missade hjärtslag kommer processen avsluta sig själv."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Standard: 10"
 
@@ -392,12 +392,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
-msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
+msgid ""
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Tjänster som stödjs: nss, pam <phrase condition=\"with_sudo\">, sudo</"
 "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
@@ -406,7 +412,7 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
@@ -416,33 +422,13 @@ msgstr ""
 "avaktiverade och administratören måste aktivera de tillåtna genom att köra: "
 "”systemctl enable sssd-@service@.socket\".  </phrase>"
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (heltal)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Antal gånger som tjänster skall försöka återansluta i händelse av en "
-"dataleverantörskrasch eller -omstart innan de ger upp"
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Standard: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domains"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -459,12 +445,12 @@ msgstr ""
 "understrykningstecken. Tecknet ”/” är förbjudet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -473,7 +459,7 @@ msgstr ""
 "innehåller användarnamnet och domänen in i dessa komponenter."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -484,12 +470,12 @@ msgstr ""
 "för mer information om dessa reguljära uttryck."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -500,32 +486,32 @@ msgstr ""
 "samman ett fullständigt kvalificerat namn från namn- och domänkomponenter."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "användarnamn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr "domännamn som det anges i SSSD-konfigurationsfilen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -534,7 +520,7 @@ msgstr ""
 "direkt konfigurerade eller hittade via IPA-förtroenden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -542,7 +528,7 @@ msgstr ""
 "Följande utvidgningar stödjs: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
@@ -551,12 +537,12 @@ msgstr ""
 "mer information om detta alternativ."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr "monitor_resolv_conf (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -565,12 +551,12 @@ msgstr ""
 "när den behöver uppdatera sin interna DNS-uppslagare."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -581,7 +567,7 @@ msgstr ""
 "sekund om inotify inte kan användas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -592,7 +578,7 @@ msgstr ""
 "alternativ sättas till ”false”"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -600,7 +586,7 @@ msgstr ""
 "Standard: true på plattformar där inotify stödjs. False på andra plattformar."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -609,12 +595,12 @@ msgstr ""
 "inte är tillgängligt. På dessa plattformar kommer pollning alltid användas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -623,7 +609,7 @@ msgstr ""
 "återuppspelning."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -633,7 +619,7 @@ msgstr ""
 "cachefilerna för återuppspelning."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -642,12 +628,12 @@ msgstr ""
 "(__LIBKRB5_DEFAULTS__ om inte konfigurerat)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr "user (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -658,7 +644,7 @@ msgstr ""
 "användaren. Det enda värdet som stödjs ”&sssd_user_name;”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
@@ -667,7 +653,7 @@ msgstr ""
 "användare en root initialt (den rekommenderade metoden)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -682,17 +668,17 @@ msgstr ""
 "köra antingen som ”&sssd_user_name;” eller ”root”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr "Standard: inte angivet, processer kommer köra som root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -707,7 +693,7 @@ msgstr ""
 "in med bara sitt användarnamn utan att dessutom ange ett domännamn."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -729,8 +715,8 @@ msgstr ""
 "default_domain_suffix används. </phrase>"
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -738,12 +724,12 @@ msgid "Default: not set"
 msgstr "Standard: inte satt"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr "override_space (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -758,7 +744,7 @@ msgstr ""
 "hantera blanka, på grund av att det är standardfältseparatorn i skalet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -771,22 +757,22 @@ msgstr ""
 "allmänhet är resultatet av en uppslagning odefinierat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Standard: inte satt (blanka kommer inte ersättas)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr "certificate_verification (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr "no_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -797,12 +783,12 @@ msgstr ""
 "nåbara från klienten."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr "soft_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -813,12 +799,12 @@ msgstr ""
 "när systemet är frånkopplat och OCSP-respondenten inte kan nås."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr "ocsp_dgst"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
@@ -827,39 +813,39 @@ msgstr ""
 "OCSP-begäran. Tillåtna värden är:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr "sha1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr "sha256"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr "sha384"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr "sha512"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 "Standard: sha1 (för att tillåta kompatibilitet med respondenter som följer "
 "RFC5019)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr "no_verification"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
@@ -868,12 +854,12 @@ msgstr ""
 "testning."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr "partial_chain"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -885,12 +871,12 @@ msgstr ""
 "certifikat som inte behöver vara självsignerat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr "ocsp_default_responder=URL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -901,12 +887,12 @@ msgstr ""
 "respondenten t.ex. http://example.com:80/ocsp."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr "ocsp_default_responder_signing_cert=NAMN"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
@@ -915,12 +901,12 @@ msgstr ""
 "vara tillgängliga i PEM-filen som anges av pam_cert_db_path."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr "crl_file=/SÖKVÄG/TILL/CRL/FIL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -933,12 +919,12 @@ msgstr ""
 "<manvolnum>1ssl</manvolnum> </citerefentry> för detaljer."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -951,7 +937,7 @@ msgstr ""
 "frånkopplat och CRL:en inte kan förnyas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -962,22 +948,22 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr "Okända alternativ rapporteras men ignoreras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr "Standard: inte satt, d.v.s begränsa inte certifikatverifieringen"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr "disable_netlink (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
@@ -986,7 +972,7 @@ msgstr ""
 "rutter, adresser, länkar och utlösa vissa åtgärder."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
@@ -995,17 +981,17 @@ msgstr ""
 "och kan avaktiveras genom att sätta detta alternativ till ”true”"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr "Standard: false (netlink-förändringar detekteras)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr "enable_files_domain (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
@@ -1014,12 +1000,12 @@ msgstr ""
 "<quote>id_provider=files</quote> före några explicit konfigurerade domäner."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr "domain_resolution_order"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -1036,7 +1022,7 @@ msgstr ""
 "kommer slås upp i en slumpvis ordning för varje föräldradomän."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -1067,18 +1053,18 @@ msgstr ""
 "användarnamn kan överlappa mellan domäner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Standard: inte satt"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr "implicit_pac_responder (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -1089,12 +1075,12 @@ msgstr ""
 "alternativ till ”false”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr "core_dumpable (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1105,17 +1091,17 @@ msgstr ""
 "klartextlösenord läcker. Se manualsidan prctl:PR_SET_DUMPABLE för detaljer."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr "passkey_verification (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr "user_verification (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
@@ -1124,7 +1110,7 @@ msgstr ""
 "under autentisering. Om aktiverat kommer PIN:en alltid att begäras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1135,7 +1121,7 @@ msgstr ""
 "servern."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -1163,12 +1149,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "TJÄNSTESEKTIONER"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1181,22 +1167,22 @@ msgstr ""
 "<quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Allmänna alternativ för tjänstekonfiguration"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Dessa alternativ kan användas för att konfigurera alla tjänster."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1211,17 +1197,17 @@ msgstr ""
 "och den ”hårda” gränsen i limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "Standard: 8192 (eller den ”hårda” gränsen i limits.conf)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1236,17 +1222,17 @@ msgstr ""
 "konfigureras kommer det att justeras till 10 sekunder."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr "Standard: 60, KCM: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1263,7 +1249,7 @@ msgstr ""
 "försök att bli uppkopplat beräknas det nya intervallet om enligt följande:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
@@ -1272,7 +1258,7 @@ msgstr ""
 "slumpvärde[0…offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1283,7 +1269,7 @@ msgstr ""
 "är 30. Slutresultatet är antalet sekunder före nästa omförsök."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
@@ -1292,18 +1278,18 @@ msgstr ""
 "offline_timeout_max (förutom slumpdelen)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Standard: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout_max (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
@@ -1312,12 +1298,12 @@ msgstr ""
 "misslyckat försök att koppla upp."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr "Ett värde på 0 avaktiverar det ökande beteendet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
@@ -1326,7 +1312,7 @@ msgstr ""
 "offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1339,7 +1325,7 @@ msgstr ""
 "åtminstone 4 gånger offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
@@ -1348,17 +1334,17 @@ msgstr ""
 "att åsidosätta värdet offline_timeout så det är inte så användbart."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr "Standard: 3600"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout_random_offset (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
@@ -1367,7 +1353,7 @@ msgstr ""
 "angivna tidsintervall:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
@@ -1377,27 +1363,27 @@ msgstr ""
 "slumptal i intervallet:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "[0 – offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr "Ett värde på 0 avaktiverar tillägget av en slumpfördröjning."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr "Standard: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr "responder_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1416,18 +1402,18 @@ msgstr ""
 "antingen uttags- eller D-Bus-aktiverade."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Standard: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr "cache_first"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
@@ -1436,12 +1422,12 @@ msgstr ""
 "den frågar dataleverantörerna."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "NSS-konfigurationsalternativ"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1449,12 +1435,12 @@ msgstr ""
 "Switch (NSS)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1463,17 +1449,17 @@ msgstr ""
 "information om alla användare)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Standard: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1484,7 +1470,7 @@ msgstr ""
 "för domänen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1499,7 +1485,7 @@ msgstr ""
 "framtida begäranden kommer behöva blockera i väntan på en cacheuppdatering."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1512,17 +1498,17 @@ msgstr ""
 "(0 avaktiverar denna funktion)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Standard: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1533,17 +1519,17 @@ msgstr ""
 "bakänden tillfrågas igen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Standard: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr "local_negative_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1554,17 +1540,17 @@ msgstr ""
 "in alternativet till 0 avaktiverar denna funktion."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr "Standard: 14400 (4 timmar)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1578,7 +1564,7 @@ msgstr ""
 "användarhuvudmansnamn (UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1591,17 +1577,17 @@ msgstr ""
 "kommer fortfarande ha medlemsanvändarna i den senare listade."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Standard: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1609,12 +1595,12 @@ msgstr ""
 "sätt då detta alternativ till false."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1623,7 +1609,7 @@ msgstr ""
 "anges av domänens dataleverantör."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1631,7 +1617,7 @@ msgstr ""
 "override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1641,23 +1627,23 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "exempel: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr "Standard: inte satt (ingen ersättning för ej angivna hemkataloger)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1668,30 +1654,30 @@ msgstr ""
 "sektionen [nss] eller per domän."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "Standard: inte angivet (SSSD kommer använda värdet som hämtats från LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 "Begränsa användarskal till ett av de listade värdena. Beräkningsordningen är:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr "1. Om skalet finns i <quote>/etc/shells</quote> används det."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1700,7 +1686,7 @@ msgstr ""
 "quote>, använd värdet på parametern shell_fallback."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1709,12 +1695,12 @@ msgstr ""
 "shells</quote> används ett nologin-skal."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr "Jokertecknet (*) kan användas för att tillåta godtyckligt skal."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1725,12 +1711,12 @@ msgstr ""
 "alla skal i allowed_shells skulle vara för mycket overhead."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "En tom sträng som skal skickas som den är till libc."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1739,27 +1725,27 @@ msgstr ""
 "att en omstart av SSSD behövs ifall ett nytt skal installeras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr "Standard: inte satt. Användarens skal används automatiskt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "Ersätt alla instanser av dessa skal med shell_fallback"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1767,17 +1753,17 @@ msgstr ""
 "maskinen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Standard: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1787,7 +1773,7 @@ msgstr ""
 "per domän."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1796,12 +1782,12 @@ msgstr ""
 "libc ersätter med något rimligt när nödvändigt, vanligen /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1810,12 +1796,12 @@ msgstr ""
 "som giltiga."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr "memcache_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
@@ -1825,7 +1811,7 @@ msgstr ""
 "minnet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
@@ -1834,8 +1820,8 @@ msgstr ""
 "påverkan på SSSD:s prestanda och skall bara användas för testning."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
@@ -1844,12 +1830,12 @@ msgstr ""
 "klientprogram inte använda den snabba cachen i minnet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr "memcache_size_passwd (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1860,13 +1846,13 @@ msgstr ""
 "lösenords-cachen i minnet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr "Standard: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
@@ -1875,12 +1861,12 @@ msgstr ""
 "negativ påverkan på SSSD:s prestanda."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr "memcache_size_group (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1891,19 +1877,19 @@ msgstr ""
 "grupp-cachen i minnet."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Standard: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr "memcache_size_initgroups (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1914,12 +1900,12 @@ msgstr ""
 "initgrupp-cachen i minnet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr "memcache_size_sid (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1932,12 +1918,12 @@ msgstr ""
 "storleken till 0 kommer avaktivera SID-cachen i minnet."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1954,7 +1940,7 @@ msgstr ""
 "citerefentry> för detaljer) men utan standardvärden."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
@@ -1963,17 +1949,17 @@ msgstr ""
 "InfoPipe-alternativet om det inte är satt för NSS-respondenten."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr "Standard: inte satt, gå tillbaka till InfoPipe-alternativet"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr "pwfield (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
@@ -1982,12 +1968,12 @@ msgstr ""
 "returnera i fältet <quote>password</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr "Standard: <quote>*</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
@@ -1996,7 +1982,7 @@ msgstr ""
 "värdet i [nss]-sektionen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -2008,12 +1994,12 @@ msgstr ""
 "<quote>x</quote> (proxydomän med målet nss_files och sssd-shadowutils)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "PAM-konfigurationsalternativ"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -2022,12 +2008,12 @@ msgstr ""
 "Authentication Module (PAM)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -2037,17 +2023,17 @@ msgstr ""
 "inloggningen)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Standard: 0 (ingen gräns)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -2056,12 +2042,12 @@ msgstr ""
 "inloggningsförsök är tillåtna."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -2070,7 +2056,7 @@ msgstr ""
 "har nåtts före ett nytt inloggningsförsök är möjligt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -2081,17 +2067,17 @@ msgstr ""
 "autentisering kan aktivera autentisering utan uppkoppling igen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Standard: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -2100,43 +2086,43 @@ msgstr ""
 "Ju högre tal desto fler meddelanden visas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "För närvarande stödjs följande värden:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: visa inte några meddelanden"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: visa endast viktiga meddelanden"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: visa informationsmeddelanden"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: visa alla meddelanden och felsökningsinformation"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Standard: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr "pam_response_filter (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2149,7 +2135,7 @@ msgstr ""
 "användaren eller miljövariabler som skall sättas av pam_sss."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
@@ -2158,37 +2144,37 @@ msgstr ""
 "gör detta alternativ att man kan filtrera ut andra sorters svar dessutom."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr "ENV"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr "Skicka inte några miljövariabler till någon tjänst."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr "ENV:varnamn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr "Skicka inte miljövariabeln varnamn till någon tjänst."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr "ENV:varnamn:tjänst"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr "Skicka inte miljövariabeln varnamn till tjänst."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -2197,7 +2183,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2214,12 +2200,12 @@ msgstr ""
 "eller ”-” eller inget av dem. Det ses som ett fel att blanda båda sätten."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr "Standard: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
@@ -2227,12 +2213,12 @@ msgstr ""
 "standardlistan"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2243,7 +2229,7 @@ msgstr ""
 "till att autentisering sker med den senaste informationen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2257,17 +2243,17 @@ msgstr ""
 "identitetsleverantören."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr "Visa en varning N dagar före lösenordet går ut."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2277,7 +2263,7 @@ msgstr ""
 "lösenordet.  Om denna information saknas kan sssd inte visa någon varning."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2286,7 +2272,7 @@ msgstr ""
 "mottogs från bakändeserver kommer den automatiskt visas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2295,17 +2281,18 @@ msgstr ""
 "<emphasis>pwd_expiration_warning</emphasis> för en viss domän."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Standard: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2320,12 +2307,12 @@ msgstr ""
 "UID vid uppstart."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr "Standard: alla användare betraktas som betrodda som standard"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
@@ -2334,12 +2321,12 @@ msgstr ""
 "inte är i listan pam_trusted_users."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
@@ -2348,20 +2335,20 @@ msgstr ""
 "betrodda användare."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 "Två speciella värden för alternativet pam_public_domains är definierade:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 "all (Ej betrodda användare tillåts komma åt alla domäner i PAM-respondenten.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2370,19 +2357,19 @@ msgstr ""
 "respondenten.)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Standard: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
@@ -2391,7 +2378,7 @@ msgstr ""
 "standardmeddelandet ”åtkomst nekas”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
@@ -2401,7 +2388,7 @@ msgstr ""
 "felsökningsinformation)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2411,12 +2398,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr "pam_account_locked_message (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
@@ -2425,7 +2412,7 @@ msgstr ""
 "standardmeddelandet ”åtkomst nekas”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2435,46 +2422,46 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr "pam_passkey_auth (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr "Aktivera autentisering baserad på lösennyckelsenhet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Standard: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr "passkey_debug_libfido2 (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr "Aktivera biblioteket libfido2 felsökningsmeddelanden."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Standard: False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr "pam_cert_auth (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2485,22 +2472,22 @@ msgstr ""
 "autentiseringsprocessen är detta alternativ avaktiverat som standard."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr "pam_cert_db_path (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr "Sökvägen till certifikatdatabasen."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr "Standard:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
@@ -2509,12 +2496,12 @@ msgstr ""
 "certifikat i PEM-format)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr "pam_cert_verification (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2528,7 +2515,7 @@ msgstr ""
 "Flaggor som stödjs är samma som för <quote>certificate_verification</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2538,7 +2525,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
@@ -2548,22 +2535,22 @@ msgstr ""
 "<quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr "p11_child_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr "Hur många sekunder pam_sss kommer vänta på p11_child att avsluta."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr "passkey_child_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
@@ -2571,12 +2558,12 @@ msgstr ""
 "avsluta."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr "pam_app_services (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
@@ -2585,12 +2572,12 @@ msgstr ""
 "<quote>application</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr "pam_p11_allowed_services (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
@@ -2599,7 +2586,7 @@ msgstr ""
 "tillåtet att använda smarta kort."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2609,7 +2596,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2629,63 +2616,63 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr "Standard: standarduppsättningen av PAM-tjänstenamn innefattar:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr "gnome-screensaver"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2695,12 +2682,12 @@ msgstr ""
 "p11_child_timeout PAM-respondenten skall vänta på att ett smartkort sätts in."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr "p11_uri (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2717,7 +2704,7 @@ msgstr ""
 "användas för att säga till p11_child att använda en specifik läsare."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2727,7 +2714,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2737,7 +2724,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2750,17 +2737,17 @@ msgstr ""
 "”p11tool” med t.ex. ”--list-all” visa även PKCS#11 URI:er."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr "pam_initgroups_scheme"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr "always"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
@@ -2768,12 +2755,12 @@ msgstr ""
 "fortfarande gäller"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr "no_session"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
@@ -2782,12 +2769,12 @@ msgstr ""
 "användaren, d.v.s. om användaren inte är inloggad för närvarande"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr "never"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
@@ -2796,7 +2783,7 @@ msgstr ""
 "inte har gått ut"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2809,17 +2796,17 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr "Standard: no_session"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr "pam_gssapi_services"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
@@ -2828,7 +2815,7 @@ msgstr ""
 "autentisering med modulen pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
@@ -2836,7 +2823,7 @@ msgstr ""
 "quote> (streck)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2847,7 +2834,7 @@ msgstr ""
 "över värdet i domänsektionen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2857,22 +2844,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Exempel: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr "Standard: - (GSSAPI-autentisering är avaktiverat)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr "pam_gssapi_check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2883,7 +2870,7 @@ msgstr ""
 "Autentisering kommer misslyckas om kontrollen misslyckas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
@@ -2892,12 +2879,12 @@ msgstr ""
 "autentiseras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr "pam_gssapi_indicators_map"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2908,7 +2895,7 @@ msgstr ""
 "autentisering med modulen pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2934,7 +2921,7 @@ msgstr ""
 "åtkomsten."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2945,7 +2932,7 @@ msgstr ""
 "specifik PAM-tjänst, lägg till <quote>tjänst:-</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
@@ -2953,7 +2940,7 @@ msgstr ""
 "Följande autentiseringsindikatorer stödjs av IPA-Kerberosinstallationer:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
@@ -2962,7 +2949,7 @@ msgstr ""
 "filer eller på smarta kort."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
@@ -2971,12 +2958,12 @@ msgstr ""
 "i en FAST-kanal."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr "radius — förautentisering med hjälp av en RADIUS-server."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
@@ -2985,12 +2972,12 @@ msgstr ""
 "(2FA eller engångslösenord, OTP) i IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr "idp — förautentisering med extern identitetsleverantör."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -3000,7 +2987,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -3011,18 +2998,18 @@ msgstr ""
 "(PKINIT), sätt <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 "Standard: inte satt (användning av autentiseringsindikatorer krävs inte)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "SUDO-konfigurationsalternativ"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -3040,12 +3027,12 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -3054,12 +3041,12 @@ msgstr ""
 "tidsberoende sudoers-poster skall evalueras eller inte."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr "sudo_threshold (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -3074,22 +3061,22 @@ msgstr ""
 "gränsvärde gäller även IPA-sudo-kommandon och kommandogruppsökningar."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "AUTOFS-konfigurationsalternativ"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr "Dessa alternativ kan användas för att konfigurera tjänsten autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -3100,22 +3087,22 @@ msgstr ""
 "finns) innan bakänden tillfrågas igen."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "SSH-konfigurationsalternativ"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr "Dessa alternativ kan användas för att konfigurera tjänsten SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -3124,12 +3111,12 @@ msgstr ""
 "till kontrollsummor eller inte."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -3138,17 +3125,17 @@ msgstr ""
 "att dess värdnycklar begärdes."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "Standard: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr "ssh_use_certificate_keys (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -3162,12 +3149,12 @@ msgstr ""
 "manvolnum> </citerefentry> för detaljer."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr "ssh_use_certificate_matching_rules (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -3182,7 +3169,7 @@ msgstr ""
 "regelnamn. Alla andra regler kommer ignoreras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -3194,7 +3181,7 @@ msgstr ""
 "certifikat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -3207,7 +3194,7 @@ msgstr ""
 "certifikatautentisering är aktiverat."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
@@ -3216,7 +3203,7 @@ msgstr ""
 "ingen regel blir vald kommer alla certifikat ignoreras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
@@ -3225,12 +3212,12 @@ msgstr ""
 "standardregeln används"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr "ca_db (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
@@ -3239,12 +3226,12 @@ msgstr ""
 "validera användarcertifikat före publika ssh-nycklar härleds från dem."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "PAC-respondentskonfigurationsalternativ"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -3262,7 +3249,7 @@ msgstr ""
 "kommer några av följande operationer att göras:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -3278,7 +3265,7 @@ msgstr ""
 "skrivas över med parametern default_shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3287,17 +3274,17 @@ msgstr ""
 "användaren läggas till i dessa grupper."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr "Dessa alternativ kan användas för att konfigurera PAC-respondenten."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3308,7 +3295,7 @@ msgstr ""
 "uppstart."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
@@ -3317,12 +3304,12 @@ msgstr ""
 "tillåts komma åt PAC-respondenten)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr "Standard: 0 (endast root-användaren tillåts komma åt PAC-respondenten)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -3336,7 +3323,7 @@ msgstr ""
 "AID:er."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3349,12 +3336,12 @@ msgstr ""
 "0 i listan av tillåtna AID:er."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr "pac_lifetime (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
@@ -3363,12 +3350,12 @@ msgstr ""
 "datan användas för att avgöra gruppmedlemskap för en användare."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr "pac_check (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3385,12 +3372,12 @@ msgstr ""
 "krb5_validate är satt till ”False” kommer PAC-kontrollerna hoppas över."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr "no_check"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
@@ -3399,12 +3386,12 @@ msgstr ""
 "kontroller att göras."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr "pac_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3415,12 +3402,12 @@ msgstr ""
 "misslyckas."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr "check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
@@ -3429,12 +3416,12 @@ msgstr ""
 "(UPN) är konsistent."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr "check_upn_allow_missing"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3453,7 +3440,7 @@ msgstr ""
 "inte längre någon anledning att sätta ”ldap_user_principal”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3471,22 +3458,22 @@ msgstr ""
 "loggmeddelandet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr "upn_dns_info_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr "PAC:en måste innehålla bufferten UPN-DNS-INFO, implicerar ”check_upn”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr "check_upn_dns_info_ex"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
@@ -3495,12 +3482,12 @@ msgstr ""
 "kontrollera om informationen i utökningen är konsistent."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr "upn_dns_info_ex_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
@@ -3509,7 +3496,7 @@ msgstr ""
 "”check_upn_dns_info_ex”, ”upn_dns_info_present” och ”check_upn”."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3518,7 +3505,7 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
@@ -3527,12 +3514,12 @@ msgstr ""
 "check_upn_allow_missing, check_upn_dns_info_ex”)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr "Konfigurationsalternativ för inspelning av sessioner"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3548,33 +3535,33 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 "Dessa alternativ kan användas för att konfigurera inspelning av sessioner."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr "scope (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr "”none”"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr "Inga användare spelas in."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr "”some”"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
@@ -3583,17 +3570,17 @@ msgstr ""
 "och <replaceable>groups</replaceable> spelas in."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr "”all”"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr "Alla användare spelas in."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3602,17 +3589,17 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr "Standard: ”none”"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr "users (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3623,17 +3610,17 @@ msgstr ""
 "efter eventuellt utbyte av mellanslag, ändring av skiftläge, etc."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr "Standard: Tomt. Matchar inte några användare."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr "groups (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3644,7 +3631,7 @@ msgstr ""
 "efter eventuellt utbyte av mellanslag, ändring av skiftläge, etc."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3656,17 +3643,17 @@ msgstr ""
 "användare måste hämtas och matchas mot grupperna användaren är en medlem i."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr "Standard: Tom. Matchar inga grupper."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr "exclude_users (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
@@ -3675,17 +3662,17 @@ msgstr ""
 "tillämpligt med ”scope=all”."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr "Standard: Tomt. Inga användare uteslutna."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr "exclude_groups (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
@@ -3694,23 +3681,23 @@ msgstr ""
 "inspelning. Endast tillämpligt med ”scope=all”."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr "Standard: Tom. Inga grupper uteslutna."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "DOMÄNSEKTIONER"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr "aktiverat"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3725,12 +3712,12 @@ msgstr ""
 "quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr "domain_type (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3743,7 +3730,7 @@ msgstr ""
 "operativsystemets gränssnitt och verktyg."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
@@ -3752,7 +3739,7 @@ msgstr ""
 "<quote>application</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3765,7 +3752,7 @@ msgstr ""
 "respondenten."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
@@ -3774,7 +3761,7 @@ msgstr ""
 "<quote>id_provider=ldap</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
@@ -3783,17 +3770,17 @@ msgstr ""
 "<quote>Programdomäner</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr "Standard: posix"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3802,7 +3789,7 @@ msgstr ""
 "utanför dessa gränser ignoreras den."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3815,7 +3802,7 @@ msgstr ""
 "ligger i intervallet rapporteras som förväntat."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3824,17 +3811,17 @@ msgstr ""
 "när de returneras via namn eller ID."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Standard: 1 för min_id, 0 (ingen gräns) för max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3847,22 +3834,22 @@ msgstr ""
 "Denna parameter kan ha ett av följande värden:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = Användare och grupper räknas upp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = Inga uppräkningar för denna domän"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Standard: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
@@ -3871,7 +3858,7 @@ msgstr ""
 "grupposter från fjärrservern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
@@ -3880,7 +3867,7 @@ msgstr ""
 "= proxy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3903,7 +3890,7 @@ msgstr ""
 "med startas om av den interna vakthunden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -3912,7 +3899,7 @@ msgstr ""
 "användar- eller grupplistan returnera utan resultat tills den är färdig."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3925,7 +3912,7 @@ msgstr ""
 "information, se manualsidorna för den specifika id-leverantören som används."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -3934,7 +3921,7 @@ msgstr ""
 "stora miljöer."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3946,32 +3933,32 @@ msgstr ""
 "konfiguration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Alla upptäckta betrodda domäner kommer räknas upp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Inga upptäckta betrodda domäner kommer räknas upp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3984,12 +3971,12 @@ msgstr ""
 "bara för dessa betrodda domäner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -3998,7 +3985,7 @@ msgstr ""
 "bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -4015,17 +4002,17 @@ msgstr ""
 "redan har cachats."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Standard: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -4034,19 +4021,19 @@ msgstr ""
 "bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "Standard: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -4055,12 +4042,12 @@ msgstr ""
 "bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -4069,12 +4056,12 @@ msgstr ""
 "frågar bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -4083,12 +4070,12 @@ msgstr ""
 "bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr "entry_cache_resolver_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
@@ -4097,12 +4084,12 @@ msgstr ""
 "den frågar bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -4111,12 +4098,12 @@ msgstr ""
 "igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -4125,12 +4112,12 @@ msgstr ""
 "giltiga före den frågar bakänden igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -4139,12 +4126,12 @@ msgstr ""
 "hur länge värdnyckeln skall cachas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr "entry_cache_computer_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
@@ -4153,12 +4140,12 @@ msgstr ""
 "igen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -4168,7 +4155,7 @@ msgstr ""
 "utgångna poster."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -4181,17 +4168,17 @@ msgstr ""
 "uppdateras både användarposten och gruppmedlemskapet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr "Denna flagga ärvs automatiskt för alla betrodda domäner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr "Du kan överväga att sätta detta värde till ¾ · entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -4211,18 +4198,18 @@ msgstr ""
 "vilja manuellt invalidera den befintliga cachen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "Standard: 0 (avaktiverat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -4239,7 +4226,7 @@ msgstr ""
 "konfiguration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -4252,12 +4239,12 @@ msgstr ""
 "och att knäcka ett lösenord med en råstyrkeattack."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr "cache_credentials_minimal_first_factor_length (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -4268,7 +4255,7 @@ msgstr ""
 "lösenord) måste ha för att sparas som en SHA512-kontrollsumma i cachen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
@@ -4278,12 +4265,12 @@ msgstr ""
 "attacker."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -4296,17 +4283,17 @@ msgstr ""
 "offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Standard: 0 (obegränsat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -4318,17 +4305,17 @@ msgstr ""
 "Dessutom måste en autentiseringsleverantör ha konfigurerats för bakänden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Standard: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -4336,12 +4323,12 @@ msgstr ""
 "stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr "<quote>proxy</quote>: Stöd en tidigare NSS-leverantör."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4352,7 +4339,7 @@ msgstr ""
 "information om hur lokala användare och grupper kan speglas in i SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4363,8 +4350,8 @@ msgstr ""
 "information om att konfigurera LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4375,8 +4362,8 @@ msgstr ""
 "manvolnum> </citerefentry> för mer information om att konfigurera FreeIPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4387,12 +4374,12 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera Active Directory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4401,7 +4388,7 @@ msgstr ""
 "full_name_format) som användarens inloggningsnamn rapporterat till NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4415,7 +4402,7 @@ msgstr ""
 "command> skulle det."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4427,7 +4414,7 @@ msgstr ""
 "namn begärs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
@@ -4436,17 +4423,17 @@ msgstr ""
 "default_domain_suffix används)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr "Returnera inte gruppmedlemmar för gruppuppslagningar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4465,7 +4452,7 @@ msgstr ""
 "som om den vore tom."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4476,11 +4463,11 @@ msgstr ""
 "innehåller många medlemmar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
@@ -4489,12 +4476,12 @@ msgstr ""
 "<emphasis>subdomain_inherit</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4503,7 +4490,7 @@ msgstr ""
 "är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4514,7 +4501,7 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4525,7 +4512,7 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
@@ -4533,12 +4520,12 @@ msgstr ""
 "PAM-mål."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> avaktiverar explicit autentisering."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4547,12 +4534,12 @@ msgstr ""
 "autentiseringsbegäranden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4563,7 +4550,7 @@ msgstr ""
 "Interna specialleverantörer är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4572,12 +4559,12 @@ msgstr ""
 "åtkomstleverantören för en lokal domän."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> neka alltid åtkomst."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4590,7 +4577,7 @@ msgstr ""
 "konfigurera åtkomstmodulen simple."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4601,24 +4588,24 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 "<quote>proxy</quote> för att skicka vidare åtkomstkontroll till någon annan "
 "PAM-modul."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Standard: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4627,7 +4614,7 @@ msgstr ""
 "av lösenordsändring som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4638,7 +4625,7 @@ msgstr ""
 "manvolnum> </citerefentry> för mer information om att konfigurera LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4649,7 +4636,7 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
@@ -4657,12 +4644,12 @@ msgstr ""
 "annat PAM-mål."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> tillåter uttryckligen inte lösenordsändringar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4671,18 +4658,18 @@ msgstr ""
 "hantera begäranden om ändring av lösenord."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "SUDO-leverantören som används för domänen.  SUDO-leverantörer som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4693,7 +4680,7 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4702,7 +4689,7 @@ msgstr ""
 "standardsinställningar för IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4711,18 +4698,18 @@ msgstr ""
 "standardsinställningar för AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> avaktiverar explicit SUDO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr "Standard: värdet på <quote>id_provider</quote> används om det är satt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4739,7 +4726,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4752,12 +4739,12 @@ msgstr ""
 "relaterad aktivitet i SSSD om du inte vill använda sudo med SSSD alls."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4768,7 +4755,7 @@ msgstr ""
 "åtkomstleverantören avslutar.  Selinux-leverantörer som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4779,14 +4766,14 @@ msgstr ""
 "manvolnum> </citerefentry> för mer information om att konfigurera IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 "<quote>none</quote> tillåter uttryckligen inte att hämta selinux-"
 "inställningar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4795,12 +4782,12 @@ msgstr ""
 "begäranden om inläsning av selinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4809,7 +4796,7 @@ msgstr ""
 "alltid vara samma som id_provider.  Underdomänsleverantörer som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4821,7 +4808,7 @@ msgstr ""
 "konfigurera IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4834,17 +4821,17 @@ msgstr ""
 "konfigurera AD-leverantören."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "<quote>none</quote> tillåter uttryckligen inte att hämta underdomäner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr "session_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -4856,14 +4843,14 @@ msgstr ""
 "med IPA.  Sessionsleverantörer som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 "<quote>ipa</quote> för att utföra uppgifter relaterade till "
 "användarsessioner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
@@ -4871,7 +4858,7 @@ msgstr ""
 "användarsessioner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
@@ -4880,12 +4867,12 @@ msgstr ""
 "sessionsrelaterade uppgifter."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -4893,7 +4880,7 @@ msgstr ""
 "är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4904,7 +4891,7 @@ msgstr ""
 "citerefentry> för mer information om att konfigurera LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4915,7 +4902,7 @@ msgstr ""
 "manvolnum> </citerefentry> för mer information om att konfigurera IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4927,17 +4914,17 @@ msgstr ""
 "leverantören."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> avaktiverar explicit autofs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -4946,7 +4933,7 @@ msgstr ""
 "leverantörer som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4957,17 +4944,17 @@ msgstr ""
 "manvolnum> </citerefentry> för mer information om att konfigurera IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> avaktiverar explicit värd-id:n."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr "resolver_provider (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
@@ -4976,7 +4963,7 @@ msgstr ""
 "Uppslagsleverantörer som stödjs är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
@@ -4985,7 +4972,7 @@ msgstr ""
 "bibliotek. Se <quote>proxy_resolver_lib_name</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4996,7 +4983,7 @@ msgstr ""
 "manvolnum> </citerefentry> för mer information om att konfigurera LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -5009,13 +4996,13 @@ msgstr ""
 "leverantören."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 "<quote>none</quote> tillåter uttryckligen inte att hämta värdar och nätverk."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -5030,7 +5017,7 @@ msgstr ""
 "(NetBIOS) namnet på domänen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
@@ -5039,17 +5026,17 @@ msgstr ""
 "name&gt;[^@]+))$</quote> vilket tillåter två olika stilar av användarnamn:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "användarnamn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "användarnamn@domän.namn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -5062,12 +5049,12 @@ msgstr ""
 "användarnamn:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "domän\\användarnamn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -5076,7 +5063,7 @@ msgstr ""
 "tredje för att tillåta enkel integration av användare från Windows-domäner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -5091,17 +5078,17 @@ msgstr ""
 "<quote>@</quote> måste de skapa sin egen re_expression."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Standard: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -5110,44 +5097,44 @@ msgstr ""
 "uppslagningar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Värden som stödjs:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: Försök slå upp IPv4-adresser, om det misslyckas, prova IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr "ipv4_only: Försök endast slå upp värdnamn som IPv4-adresser."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: Försök slå upp IPv6-adresser, om det misslyckas, prova IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr "ipv6_only: Försök endast slå upp värdnamn som IPv6-adresser."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Standard: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_server_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
@@ -5156,7 +5143,7 @@ msgstr ""
 "DNS-server före den provar nästa DNS-server."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
@@ -5164,7 +5151,7 @@ msgstr ""
 "pingtidsgränsen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
@@ -5172,17 +5159,17 @@ msgstr ""
 "Se avsnittet <quote>RESERVER</quote> för mer information om tjänstevalet."
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Standard: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
@@ -5192,13 +5179,18 @@ msgstr ""
 "fråga (t.ex. uppslagning av ett värdnamn eller en SRV-post) före den provar "
 "nästa värdnamn eller DNS-upptäckt."
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Standard: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -5210,12 +5202,12 @@ msgstr ""
 "nås kommer domänen fortsätta att fungera i frånkopplat läge."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_use_search_list (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -5226,7 +5218,7 @@ msgstr ""
 "med felaktigt konfigurerad DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -5237,17 +5229,17 @@ msgstr ""
 "DNS-uppslagningar i sådana miljöer."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Standard: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -5256,17 +5248,17 @@ msgstr ""
 "fråga om tjänsteupptäckt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr "Standard: använd domändelen av maskinens värdnamn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr "failover_primary_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -5277,57 +5269,57 @@ msgstr ""
 "den försöker återansluta till primärservern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr "Observera: minimivärdet är 31."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 msgid "Default: 31"
 msgstr "Standard: 31"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "Ersätt det primära GID-värdet med det angivna."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr "Skiftlägeskänsligt. Detta värde är inte giltigt för AD-leverantörer."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr "Skiftlägesokänsligt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -5338,7 +5330,7 @@ msgstr ""
 "tjänster även protokollnamn) fortfarande skiftas ner i utdata."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
@@ -5347,7 +5339,7 @@ msgstr ""
 "du sätta det på både klienten och SSSD på servern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -5356,17 +5348,17 @@ msgstr ""
 "värdena på alternativen är: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr "Standard: True (False för AD-leverantören)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -5377,47 +5369,47 @@ msgstr ""
 "följande alternativ ärvas:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr "ldap_offline_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
@@ -5426,57 +5418,57 @@ msgstr ""
 "ldap_krb5_keytab sätts särskilt)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr "auto_private_groups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr "case_sensitive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5486,28 +5478,28 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 "Observera: detta alternativ fungerar endast med leverantörerna IPA och AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "platt (NetBIOS) namn på en underdomän."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5522,36 +5514,36 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 "Värdet kan åsidosättas av alternativet <emphasis>override_homedir</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Standard: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 "Diverse taggar lagrade av realmd-konfigurationstjänsten för denna domän."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr "cached_auth_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5564,7 +5556,7 @@ msgstr ""
 "uppkopplad autentisering."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
@@ -5573,12 +5565,12 @@ msgstr ""
 "inte möjligt att ange olika värden för varje betrodd domän."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr "Specialvärdet 0 betyder att denna funktion är avaktiverad."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5589,12 +5581,12 @@ msgstr ""
 "<quote>initgroups.</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr "local_auth_policy (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5613,7 +5605,7 @@ msgstr ""
 "vilka utvärderas och kontrolleras lokalt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5633,7 +5625,7 @@ msgstr ""
 "quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5644,42 +5636,42 @@ msgstr ""
 "med standard local_auth_policy: <quote>match</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr "local_auth_policy = match (standard)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr "Lösennyckel"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr "Smartkort"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr "avaktiverad"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr "LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5692,7 +5684,7 @@ msgstr ""
 "vara en PIN-prompt istället för t.ex. en lösenordsprompt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5708,7 +5700,7 @@ msgstr ""
 "local_auth_policy = only\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5719,7 +5711,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
@@ -5729,22 +5721,22 @@ msgstr ""
 "standard."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 msgid "Default: match"
 msgstr "Standard: match"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr "auto_private_groups (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr "true"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
@@ -5753,7 +5745,7 @@ msgstr ""
 "GID-numret ignoreras i detta läge."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5766,12 +5758,12 @@ msgstr ""
 "framtvingar unika nummer över hela ID-rymden."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr "false"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
@@ -5780,12 +5772,12 @@ msgstr ""
 "ett gruppobjekt i LDAP-databasen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr "hybrid"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5800,7 +5792,7 @@ msgstr ""
 "upp till det gruppobjektet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
@@ -5809,7 +5801,7 @@ msgstr ""
 "kan GID:t helt enkelt inte slås upp."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5820,7 +5812,7 @@ msgstr ""
 "befintliga användarnas privata grupper."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -5829,7 +5821,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
@@ -5839,7 +5831,7 @@ msgstr ""
 "översättning."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -5849,7 +5841,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -5861,7 +5853,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -5875,7 +5867,7 @@ msgstr ""
 "id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -5886,17 +5878,17 @@ msgstr ""
 "replaceable>]</quote> <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "Proxymålet PAM är en proxy för."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -5907,12 +5899,12 @@ msgstr ""
 "man aktivera lokal autentisering med alternativet local_auth_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -5923,12 +5915,12 @@ msgstr ""
 "exempel _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr "proxy_resolver_lib_name (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -5939,12 +5931,12 @@ msgstr ""
 "_nss_$(libName)_$(function), till exempel _nss_dns_gethostbyname2_r."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -5957,12 +5949,12 @@ msgstr ""
 "SSSD att utföra ID-uppslagningen från cachen av prestandaskäl."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr "proxy_max_children (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -5974,7 +5966,7 @@ msgstr ""
 "begäranden skulle köas upp."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -5983,12 +5975,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr "Programdomäner"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -6017,7 +6009,7 @@ msgstr ""
 "traditionell SSSD-domän."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -6028,17 +6020,17 @@ msgstr ""
 "programdomänen och dess POSIX-syskondomän sätts korrekt."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr "Programdomänparametrar"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr "inherit_from (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -6051,7 +6043,7 @@ msgstr ""
 "quote>domänens inställningar."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -6066,7 +6058,7 @@ msgstr ""
 "attributet telefon nåbart via D-Bus-gränssnittet."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6100,12 +6092,12 @@ msgstr ""
 "ldap_user_extra_attrs = telefon:telephoneNumber\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr "SEKTIONEN BETRODDA DOMÄNER"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -6122,57 +6114,57 @@ msgstr ""
 "alternativ i sektionen för betrodda domäner är:"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr "ldap_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr "ldap_user_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr "ldap_group_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr "ldap_netgroup_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr "ldap_service_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr "ldap_sasl_mech,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr "ad_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr "ad_backup_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr "ad_site,"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr "use_fully_qualified_names"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
@@ -6181,12 +6173,12 @@ msgstr ""
 "manualsidan."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr "CERTIFIKATSMAPPNINGSSEKTION"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -6208,7 +6200,7 @@ msgstr ""
 "fallet när lokala tjänster använder PAM för autentisering."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -6220,7 +6212,7 @@ msgstr ""
 "detaljer)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -6233,12 +6225,12 @@ msgstr ""
 "replaceable>]</quote>.  I denna sektion är följande alternativ tillåtna:"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr "matchrule (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
@@ -6247,7 +6239,7 @@ msgstr ""
 "alla andra ignoreras."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
@@ -6256,17 +6248,17 @@ msgstr ""
 "Extended Key Usage <quote>clientAuth</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr "maprule (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr "Definierar hur användaren hittas för ett givet certifikat."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
@@ -6275,7 +6267,7 @@ msgstr ""
 "<quote>ldap</quote>, <quote>AD</quote> eller <quote>ipa</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
@@ -6284,12 +6276,12 @@ msgstr ""
 "användare med samma namn."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr "domains (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -6302,17 +6294,17 @@ msgstr ""
 "lägga till regeln till underdomäner också."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr "Standard: den konfigurerade domänen i sssd.conf"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr "priority (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -6323,12 +6315,12 @@ msgstr ""
 "prioriteten medan <quote>4294967295</quote> är den lägsta."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr "Standard: den lägsta prioriteten"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
@@ -6338,7 +6330,7 @@ msgstr ""
 "speciella egenskaper:"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
@@ -6347,7 +6339,7 @@ msgstr ""
 "användaren"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -6360,17 +6352,17 @@ msgstr ""
 "short_name})</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr "alternativet <quote>domains</quote> ignoreras"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr "SEKTIONEN FÖR FRÅGEKONFIGURATION"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -6385,7 +6377,7 @@ msgstr ""
 "tillämpliga kreditiv."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -6398,22 +6390,22 @@ msgstr ""
 "användarfall. Följande alternativ bör ge en bättre flexibilitet här."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr "password_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr "för att ändra strängen i lösenordsfrågan"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6422,37 +6414,37 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr "[prompting/2fa]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr "för att ändra strängen som frågar efter den första faktorn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr "second_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr "för att ändra strängen som frågar efter den andra faktorn"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr "single_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -6465,7 +6457,7 @@ msgstr ""
 "faktorn är frivillig."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -6477,18 +6469,29 @@ msgstr ""
 "faktorn är frivillig och det skall vara möjligt att logga in antingen edast "
 "med lösenordet eller med båda faktorerna måste tvåstegsförfrågan användas."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr "[prompting/passkey]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr "interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -6499,22 +6502,22 @@ msgstr ""
 "utlösare."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr "interactive_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr "för att ändra meddelandet i den interaktiva frågan."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr "touch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
@@ -6523,17 +6526,17 @@ msgstr ""
 "enheten."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr "touch_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr "för att ändra meddelandet i begäran om beröring."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -6542,7 +6545,7 @@ msgstr ""
 "alternativen: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -6555,7 +6558,7 @@ msgstr ""
 "> <placeholder type=\"variablelist\" id=\"2\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -6566,12 +6569,12 @@ msgstr ""
 "enskilt för denna tjänst."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr "EXEMPEL"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6623,7 +6626,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6635,7 +6638,7 @@ msgstr ""
 "domäner för fler detaljer. <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6645,7 +6648,7 @@ msgstr ""
 "use_fully_qualified_names = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6661,7 +6664,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6677,7 +6680,7 @@ msgstr ""
 "priority = 10\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -6873,7 +6876,7 @@ msgstr ""
 "ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Exempel:"
@@ -7377,7 +7380,7 @@ msgstr ""
 "<emphasis>ldap_connection_expire_offset</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "Standard: 900 (15 minuter)"
 
@@ -7695,7 +7698,7 @@ msgstr ""
 "<command>sssd</command> kommer godkänna."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -7710,11 +7713,19 @@ msgstr "ldap_tls_cacertdir (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "Anger sökvägen till en katalog som innehåller certifikat för "
 "Certifikatauktoriteter i individuella filer.  Typiskt måste filnamnen vara "
@@ -7723,32 +7734,32 @@ msgstr ""
 "namnen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr "Anger filen som innehåller certifikatet för klientens nyckel."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "Anger filen som innehåller klientens nyckel."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -7759,12 +7770,12 @@ msgstr ""
 "manvolnum></citerefentry> för formatet."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -7775,12 +7786,12 @@ msgstr ""
 "emphasis> rekommenderas starkt av säkerhetsskäl."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -7791,18 +7802,18 @@ msgstr ""
 "förlita sig på ldap_user_uid_number och ldap_group_gid_number."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "För närvarande stödjer denna funktion endast ActiveDirectory objectSID."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr "ldap_min_id, ldap_max_id (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -7820,17 +7831,17 @@ msgstr ""
 "Underdomäner kan sedan välja andra intervall för att översätta ID:n."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr "Standard: inte satt (båda alternativen är satta till 0)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
@@ -7839,7 +7850,7 @@ msgstr ""
 "GSSAPI och GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -7855,12 +7866,12 @@ msgstr ""
 "conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> för detaljer."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -7880,7 +7891,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -7900,17 +7911,17 @@ msgstr ""
 "keytab."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "Standard: host/värdnamn@RIKE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -7921,17 +7932,17 @@ msgstr ""
 "ignoreras detta alternativ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "Standard: värdet på krb5_realm."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -7940,34 +7951,34 @@ msgstr ""
 "att ta fram värdnamnets kanoniska form under en SASL-bindning."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Standard: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 "Ange den keytab som skall användas vid användning av SASL/GSSAPI/GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Standard: Systemets keytab, normalt <filename>/etc/krb5.keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -7978,29 +7989,29 @@ msgstr ""
 "eller GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 "Anger livslängden i sekunder på TGT:n om GSSAPI eller GSS-SPNEGO används."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Standard: 86400 (24 timmar)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -8018,7 +8029,7 @@ msgstr ""
 "mer information, se avsnittet <quote>TJÄNSTEUPPTÄCKT</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -8029,7 +8040,7 @@ msgstr ""
 "hittas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -8041,27 +8052,27 @@ msgstr ""
 "quote> istället."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr "Ange Kerberos-RIKE (för SASL/GSSAPI/GSS-SPNEGO aut)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr "Standard: Systemstandard, se <filename>/etc/krb5.conf</filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -8070,12 +8081,12 @@ msgstr ""
 "servern. Denna funktion är tillgänglig med MIT Kerberos ≥ 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -8090,7 +8101,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -8101,12 +8112,12 @@ msgstr ""
 "om lokaliseringsinsticksmodulen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -8115,7 +8126,7 @@ msgstr ""
 "värden är tillåtna:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -8124,7 +8135,7 @@ msgstr ""
 "alternativ kan inte avaktivera lösenordspolicyer på serversidan."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -8137,7 +8148,7 @@ msgstr ""
 "även alternativet ”ldap_chpass_update_last_change”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -8148,7 +8159,7 @@ msgstr ""
 "chpass_provider=krb5 för att uppdatera dessa attribut när lösenordet ändras."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
@@ -8157,17 +8168,17 @@ msgstr ""
 "kommer den alltid gå före framför policyn som sätts med detta alternativ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr "Anger huruvida automatisk uppföljning av referenser skall aktiveras."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -8176,7 +8187,7 @@ msgstr ""
 "kompilerad med OpenLDAP version 2.4.13 eller senare."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -8197,28 +8208,28 @@ msgstr ""
 "data vara tillgängliga."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "Anger tjänstenamnet som skall användas när tjänsteupptäckt är aktiverat."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Standard: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -8227,17 +8238,17 @@ msgstr ""
 "lösenordsändringar när tjänsteupptäckt är aktiverat."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr "Standard: inte satt, d.v.s. tjänsteupptäckt är avaktiverat"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
@@ -8246,7 +8257,7 @@ msgstr ""
 "dagar sedan epoken efter en ändring av lösenord."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -8259,12 +8270,12 @@ msgstr ""
 "SSSD måste uppdatera det."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -8292,12 +8303,12 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Exempel:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -8309,7 +8320,7 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
@@ -8318,7 +8329,7 @@ msgstr ""
 "användare vars attribut employeeType är satt till ”admin”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -8331,17 +8342,17 @@ msgstr ""
 "fortsätta ges åtkomst under frånkoppling, och vice versa."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "Standard: Empty"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -8350,7 +8361,7 @@ msgstr ""
 "åtkomststyrningsattribut aktiveras."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -8361,12 +8372,12 @@ msgstr ""
 "felkod även om lösenordet är korrekt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Följande värden är tillåtna:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -8375,7 +8386,7 @@ msgstr ""
 "att avgöra om kontot har gått ut."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -8388,7 +8399,7 @@ msgstr ""
 "kontrolleras också."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -8399,7 +8410,7 @@ msgstr ""
 "tillåts eller inte."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -8411,7 +8422,7 @@ msgstr ""
 "för att avgöra om åtkomst tillåts. Om båda attributen saknas tillåts åtkomst."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -8422,23 +8433,23 @@ msgstr ""
 "ldap_account_expire_policy skall fungera."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "Kommaseparerad lista över åtkomststyrningsalternativ.  Tillåtna värden är:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis>: använd ldap_access_filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8453,7 +8464,7 @@ msgstr ""
 "fungera."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
@@ -8463,7 +8474,7 @@ msgstr ""
 "emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8484,12 +8495,12 @@ msgstr ""
 "måste vara satt för att denna funktion skall fungera."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr "<emphasis>expire</emphasis>: använd ldap_account_expire_policy"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -8504,7 +8515,7 @@ msgstr ""
 "exempel SSH-nycklar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
@@ -8513,17 +8524,17 @@ msgstr ""
 "lösenord gått ut:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr "pwd_expire_policy_reject — användaren nekas att logga in,"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr "pwd_expire_policy_warn — användaren kan fortfarande logga in,"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
@@ -8532,17 +8543,23 @@ msgstr ""
 "omedelbart."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
+#, fuzzy
+#| msgid ""
+#| "Please note that 'access_provider = ldap' must be set for this feature to "
+#| "work. Also 'ldap_pwd_policy' must be set to an appropriate password "
+#| "policy."
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 "Observera att ”access_provider = ldap” måste vara satt för att denna "
 "funktion skall fungera. ”ldap_pwd_policy” måste också vara satt till en "
 "lämplig lösenordspolicy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -8551,13 +8568,13 @@ msgstr ""
 "för att avgöra åtkomst"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis>: använd attributet host för att avgöra åtkomst"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
@@ -8566,7 +8583,7 @@ msgstr ""
 "fjärrvärdar kan få åtkomst"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
@@ -8576,12 +8593,12 @@ msgstr ""
 "åtkomstkontroll aktiveras"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Standard: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -8590,12 +8607,12 @@ msgstr ""
 "gång."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr "ldap_pwdlockout_dn (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -8608,22 +8625,22 @@ msgstr ""
 "LDAP-servern inte kan kontrolleras ordentligt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr "Exempel: cn=ppolicy,ou=policies,dc=example,dc=com"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr "Standard: cn=ppolicy,ou=policies,$ldap_search_base"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -8632,12 +8649,12 @@ msgstr ""
 "alternativ är tillåtna:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr "<emphasis>never</emphasis>: Alias är aldrig derefererade."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -8646,7 +8663,7 @@ msgstr ""
 "basobjektet, men inte vid lokalisering av basobjektet för sökningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -8655,7 +8672,7 @@ msgstr ""
 "basobjektet för sökningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -8664,7 +8681,7 @@ msgstr ""
 "lokalisering av basobjektet för sökningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -8673,12 +8690,12 @@ msgstr ""
 "klientbiblioteken)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -8687,7 +8704,7 @@ msgstr ""
 "servrar som använder schemat RFC2307."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -8704,7 +8721,7 @@ msgstr ""
 "via anrop av getpw*() eller initgroups()."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -8715,12 +8732,12 @@ msgstr ""
 "de lokala användarna med de extra LDAP-grupperna."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr "wildcard_limit (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
@@ -8729,23 +8746,23 @@ msgstr ""
 "jokertecken."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 "För närvarande stödjer endast respondenten InfoPipe jokeruppslagningar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr "Standard: 1000 (ofta storleken på en sida)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr "ldap_library_debug_level (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
@@ -8754,7 +8771,7 @@ msgstr ""
 "kommer skrivas oberoende av den allmänna debug_level."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
@@ -8763,17 +8780,17 @@ msgstr ""
 "komponenter, -1 kommer aktivera fullständig felsökningsutmatning."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "Standard: 0 (libldap-felsökning avaktiverat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_use_ppolicy (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
@@ -8783,6 +8800,24 @@ msgstr ""
 "lösenordspolicy. Avaktivering av detta möjliggör interaktion med tjänster "
 "vilka skickar tillbaka felaktiga ppolicy-utökningar."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (heltal)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -8804,12 +8839,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "SUDOALTERNATIV"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -8820,12 +8855,12 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
@@ -8835,7 +8870,7 @@ msgstr ""
 "servern)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -8844,7 +8879,7 @@ msgstr ""
 "emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
@@ -8853,17 +8888,17 @@ msgstr ""
 "0. Dock måste antingen smart eller fullständig uppdatering aktiveras."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "Standard: 21600 (6 timmar)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -8874,7 +8909,7 @@ msgstr ""
 "USN-värde som för närvarande är känt av SSSD)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
@@ -8883,7 +8918,7 @@ msgstr ""
 "istället."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -8899,7 +8934,7 @@ msgstr ""
 "<emphasis>ldap_connection_expire_timeout</emphasis>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
@@ -8908,12 +8943,12 @@ msgstr ""
 "Dock måste antingen smart eller fullständig uppdatering aktiveras."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_sudo_random_offset (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -8924,7 +8959,7 @@ msgstr ""
 "schemaläggs. Värdet är i sekunder."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -8935,17 +8970,17 @@ msgstr ""
 "tiden under vilken sudo-reglerna inte är tillgängliga för användning."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr "Man kan avaktivera denna fördröjning genom att sätta värdet till 0."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
@@ -8954,12 +8989,12 @@ msgstr ""
 "(genom användning av IPv4- och IPv6-värd-/-nätverksadresser och värdnamn)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -8968,7 +9003,7 @@ msgstr ""
 "domännamn som skall användas för att filtrera reglerna."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
@@ -8977,8 +9012,8 @@ msgstr ""
 "fullständigt kvalificerade domännamnet automatiskt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -8987,17 +9022,17 @@ msgstr ""
 "emphasis> har detta alternativ ingen effekt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "Standard: inte angivet"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -9006,7 +9041,7 @@ msgstr ""
 "skall användas för att filtrera reglerna."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -9015,12 +9050,12 @@ msgstr ""
 "automatiskt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
@@ -9029,12 +9064,12 @@ msgstr ""
 "attributet sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
@@ -9043,7 +9078,7 @@ msgstr ""
 "attributet sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
@@ -9052,7 +9087,7 @@ msgstr ""
 "LDAP-serversidan!"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -9065,12 +9100,12 @@ msgstr ""
 "manvolnum> </citerefentry>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "AUTOFSALTERNATIV"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
@@ -9078,47 +9113,47 @@ msgstr ""
 "Några av standardvärdena för parametrar nedan är beroende på LDAP-schemat."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "Namnet på automount master-kartan i LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "Standard: auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "AVANCERADE ALTERNATIV"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr "<note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -9131,22 +9166,22 @@ msgstr ""
 "avaktivera denna funktion om gruppnamn inte visas korrekt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr "</note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -9159,14 +9194,14 @@ msgstr ""
 "type=\"variablelist\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "EXEMPEL"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -9176,7 +9211,7 @@ msgstr ""
 "till en av domänerna i avsnittet <replaceable>[domains]</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9196,20 +9231,20 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr "LDAP-ÅTKOMSTFILTEREXEMPEL"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
@@ -9218,7 +9253,7 @@ msgstr ""
 "ldap_access_order=lockout används."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9244,13 +9279,13 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTER"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -12038,7 +12073,7 @@ msgstr ""
 "identifiera denna värd.  Värdnamnet måste vara fullständigt kvalificerat."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (boolean)"
 
@@ -12058,7 +12093,7 @@ msgstr ""
 "alternativet <quote>dyndns_iface</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -12078,12 +12113,12 @@ msgstr ""
 "använda <emphasis>dyndns_update</emphasis> i sin konfigurationsfil."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -12110,12 +12145,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Standard: 1200 (sekunder)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -12148,17 +12183,17 @@ msgstr ""
 "förbindelsen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr "Exempel: dyndns_iface = em1, vnet1, vnet2"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr "dyndns_auth (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -12169,17 +12204,17 @@ msgstr ""
 "sätta detta alternativ till ”none”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr "Standard: GSS-TSIG"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_auth_ptr (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -12190,7 +12225,7 @@ msgstr ""
 "sätta detta alternativ till ”none”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr "Standard: samma som dyndns_auth"
 
@@ -12224,7 +12259,7 @@ msgstr ""
 "upptäckten används som backup-servrar"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (heltal)"
 
@@ -12240,12 +12275,12 @@ msgstr ""
 "alternativ är valfritt och tillämpligt endast när dyndns_update är sann."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -12263,7 +12298,7 @@ msgstr ""
 "servern genererar PTR-posterna automatiskt när framåtposterna ändras."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -12278,12 +12313,12 @@ msgid "Default: False (disabled)"
 msgstr "Standard: False (avaktiverat)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -12292,17 +12327,17 @@ msgstr ""
 "med DNS-servern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Standard: False (låt nsupdate välja protokollet)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr "dyndns_server (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
@@ -12311,7 +12346,7 @@ msgstr ""
 "flesta uppsättningar rekommenderas det att låta detta alternativ vara osatt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
@@ -12320,7 +12355,7 @@ msgstr ""
 "skild från identitetsservern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
@@ -12330,17 +12365,17 @@ msgstr ""
 "inställningar misslyckas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr "Standard: Ingen (låt nsupdate välja servern)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr "dyndns_update_per_family (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -12507,12 +12542,12 @@ msgstr ""
 "till bas-DN:en för att användas när LDAP-operationer utförs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr "krb5_confd_path (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
@@ -12521,7 +12556,7 @@ msgstr ""
 "för Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
@@ -12530,7 +12565,7 @@ msgstr ""
 "”none”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -12554,7 +12589,7 @@ msgstr ""
 "görs många begäranden om skrivbordsprofiler under en kort tid."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "Standard: 5 (sekunder)"
 
@@ -13447,18 +13482,16 @@ msgstr "ad_access_filter (sträng)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
-"Detta alternativ anger LDAP:s åtkomstkontrollfilter som användaren måste "
-"matcha för att tillåtas åtkomst.  Observera att alternativet "
-"<quote>access_provider</quote> måste vara uttryckligen satt till <quote>ad</"
-"quote> för att detta alternativ skall ha någon effekt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -13471,7 +13504,7 @@ msgstr ""
 "eller utelämnas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -13484,7 +13517,7 @@ msgstr ""
 "domäner från skogen som anges av <quote>NAMN</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
@@ -13493,7 +13526,7 @@ msgstr ""
 "sökbaser fungerar."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -13514,7 +13547,7 @@ msgstr ""
 "utökningar</ulink>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -13527,7 +13560,7 @@ msgstr ""
 "fler matchningar med samma specifikation används den första."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -13557,12 +13590,12 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr "ad_site (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
@@ -13571,12 +13604,12 @@ msgstr ""
 "alternativ inte anges kommer AD-sajten att automatupptäckas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -13589,7 +13622,7 @@ msgstr ""
 "endast ansluter till LDAP-porten på den aktuella AD-servern."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -13602,12 +13635,12 @@ msgstr ""
 "användas för att slå upp gruppmedlemskap över domäner."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -13622,7 +13655,7 @@ msgstr ""
 "quote> för att detta alternativ skall ha någon effekt."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -13635,7 +13668,7 @@ msgstr ""
 "policyinställningarna se flaggan  <quote>ad_gpo_map</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -13648,7 +13681,7 @@ msgstr ""
 "uppströms ärendehanterare https://github.com/SSSD/sssd/issues/5063 ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -13663,7 +13696,7 @@ msgstr ""
 "grupper den tillhör ha följande rättigheter på GPO:n:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
@@ -13672,7 +13705,7 @@ msgstr ""
 "egenskaperna hos GPO:n (RIGHT_DS_READ_PROPERTY)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
@@ -13681,7 +13714,7 @@ msgstr ""
 "ha tillåtelse att verkställa GPO:n (RIGHT_DS_CONTROL_ACCESS)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -13696,7 +13729,7 @@ msgstr ""
 "autentiserade användarens grupprättigheter på GPO:n för användaren."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -13722,12 +13755,12 @@ msgstr ""
 "<manvolnum>8</manvolnum></citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr "Det finns tre stödda värden för detta alternativ:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
@@ -13735,12 +13768,12 @@ msgstr ""
 "påtvingas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr "enforcing: GPO-baserade åtkomstkontrollregler evalueras och påtvingas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -13752,22 +13785,22 @@ msgstr ""
 "till enforcing."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "Standard: permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr "Standard: enforcing"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr "ad_gpo_implicit_deny (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -13785,7 +13818,7 @@ msgstr ""
 "tillämpliga på dem."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -13796,74 +13829,74 @@ msgstr ""
 "på serversidan och inställningen av ad_gpo_implicit_deny."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr "ad_gpo_implicit_deny = False (standard)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr "tillåtelseregler"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr "nekanderegler"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr "resultat"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr "saknas"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr "alla användare tillåts"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr "finns"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr "endast användare som inte finns i nekanderegler tillåts"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr "endast användare i tillåtelseregler tillåts"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr "endast användare i tillåtelse och inte i nekanderegler tillåts"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr "ad_gpo_implicit_deny = True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr "inga användare tillåts"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr "ad_gpo_ignore_unreadable (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -13878,12 +13911,12 @@ msgstr ""
 "för SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr "ad_gpo_cache_timeout (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -13894,12 +13927,12 @@ msgstr ""
 "begäranden om åtkomstkontroll under en kort tid."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr "ad_gpo_map_interactive (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -13927,7 +13960,7 @@ msgstr ""
 "policyinställningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
@@ -13936,7 +13969,7 @@ msgstr ""
 "”Tillåt inloggning lokalt” och ”Neka inloggning lokalt”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -13946,7 +13979,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -13966,42 +13999,42 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr "gdm-fingerprint"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr "lightdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr "lxdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr "sddm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr "unity"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr "xdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr "ad_gpo_map_remote_interactive (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -14029,7 +14062,7 @@ msgstr ""
 "den policyinställningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -14040,7 +14073,7 @@ msgstr ""
 "fjärrinloggningstjänster”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -14050,7 +14083,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14070,22 +14103,22 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr "sshd"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr "cockpit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr "ad_gpo_map_network (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -14112,7 +14145,7 @@ msgstr ""
 "denne eller åtminstone en av dess grupper är del av den policyinställningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -14123,7 +14156,7 @@ msgstr ""
 "nätverket”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -14133,7 +14166,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14153,22 +14186,22 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr "ftp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr "samba"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr "ad_gpo_map_batch (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -14195,7 +14228,7 @@ msgstr ""
 "policyinställningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
@@ -14205,7 +14238,7 @@ msgstr ""
 "jobb”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -14215,7 +14248,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14235,7 +14268,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
@@ -14243,17 +14276,17 @@ msgstr ""
 "används."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr "crond"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr "ad_gpo_map_service (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -14280,7 +14313,7 @@ msgstr ""
 "denne eller åtminstone en av dess grupper är del av den policyinställningen."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
@@ -14289,7 +14322,7 @@ msgstr ""
 "”Tillåt inloggning som en tjänst” och ”Neka inloggning som en tjänst”."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -14299,7 +14332,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -14317,12 +14350,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr "ad_gpo_map_permit (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
@@ -14331,7 +14364,7 @@ msgstr ""
 "alltid tillåts, oavsett några andra GPO-inloggningsrättigheter."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -14341,7 +14374,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14361,22 +14394,22 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr "polkit-1"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr "systemd-user"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr "ad_gpo_map_deny (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
@@ -14385,7 +14418,7 @@ msgstr ""
 "alltid nekas, oavsett några andra GPO-inloggningsrättigheter."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -14395,12 +14428,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr "ad_gpo_default_right (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -14422,52 +14455,52 @@ msgstr ""
 "för omappade PAM-tjänstenamn."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr "Värden som stödjs för detta alternativ inkluderar:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr "remote_interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr "network"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr "batch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr "service"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr "permit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr "deny"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr "Standard: deny"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr "ad_maximum_machine_account_password_age (heltal)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -14478,17 +14511,17 @@ msgstr ""
 "förhindra förnyelseförsöket."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr "Standard: 30 dagar"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr "ad_machine_account_password_renewal_opts (sträng)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -14503,17 +14536,17 @@ msgstr ""
 "i sekunder före funktionen körs för första gången efter uppstart."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr "Standard: 86400:750 (24h och 15m)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr "ad_update_samba_machine_account_password (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -14526,12 +14559,12 @@ msgstr ""
 "AD för autentisering."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr "ad_use_ldaps (bool)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -14549,12 +14582,12 @@ msgstr ""
 "(noll) för dessa förbindelser."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ad_allow_remote_domain_local_groups (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -14571,7 +14604,7 @@ msgstr ""
 "Linuxklienter lades detta alternativ till."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -14596,7 +14629,7 @@ msgstr ""
 "också de domänlokala fjärrgrupperna saknas."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -14616,7 +14649,7 @@ msgstr ""
 "endast finns med en djupare nästningsnivå."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -14633,12 +14666,12 @@ msgstr ""
 "på annat sätt med alternativet <quote>dyndns_iface</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "Standard: 3600 (sekunder)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
@@ -14647,7 +14680,7 @@ msgstr ""
 "förbindelsen"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -14662,7 +14695,7 @@ msgstr ""
 "mindre än 60 ges kommer parametern endast anta det lägsta värdet."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -14673,7 +14706,7 @@ msgstr ""
 "exempel visar endast alternativ som är specifika för leverantören AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -14697,7 +14730,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -14709,7 +14742,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -14720,7 +14753,7 @@ msgstr ""
 "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -14735,7 +14768,7 @@ msgstr ""
 "krypteringsdetaljer) manuellt."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -15362,60 +15395,73 @@ msgstr ""
 "för att testa.  Signalen kan skickas antingen till sssd-processen eller "
 "direkt till någon sssd_be-process."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr "SLUTSTATUS"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr "0"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr "SSSD stängdes av snyggt."
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr "Felaktig konfiguration eller kommandoradsflagga."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr "2"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr "Minnesallokeringsfel."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr "6"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr "SSSD kör redan."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr "Andra koder"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
@@ -15424,7 +15470,7 @@ msgstr ""
 "åtkomsträttigheter. Se SSSD:s och systemets loggar för detaljer."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
@@ -15433,7 +15479,7 @@ msgstr ""
 "klientprogram inte använda den snabba cachen i minnet."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -17687,9 +17733,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
 #: sss_ssh_knownhosts.1.xml:47
-#, no-wrap
+#, fuzzy, no-wrap
+#| msgid ""
+#| "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+#| "            "
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
@@ -17708,10 +17757,10 @@ msgstr ""
 "<citerefentry><refentrytitle>ssh</refentrytitle> <manvolnum>1</manvolnum></"
 "citerefentry> kan konfigureras till att använda <command>sss_ssh_knownhosts</"
 "command> för autentisering med värdens publika nyckel med alternativet "
-"<quote>KnownHostsCommand</quote>: <placeholder type=\"programlisting\" id=\"0"
-"\"/> Se manualsidan <citerefentry> <refentrytitle>ssh_config</refentrytitle> "
-"<manvolnum>5</manvolnum> </citerefentry> för mer detaljer om detta "
-"alternativ."
+"<quote>KnownHostsCommand</quote>: <placeholder type=\"programlisting\" "
+"id=\"0\"/> Se manualsidan <citerefentry> <refentrytitle>ssh_config</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry> för mer detaljer om "
+"detta alternativ."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: sss_ssh_knownhosts.1.xml:65 sss_ssh_knownhostsproxy.1.xml:93
@@ -17721,8 +17770,59 @@ msgstr ""
 "Sök efter värdars publika nycklar i SSSD-domänen <replaceable>DOMÄN</"
 "replaceable>."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-H</option>,<option>--ssh-hosts</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-H</option>,<option>--ssh-hosts</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -22117,6 +22217,45 @@ msgstr ""
 
 #. type: Content of: <refsect1><para>
 #: include/seealso.xml:4
+#, fuzzy
+#| msgid ""
+#| "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</"
+#| "manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-attributes</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-simple</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ad</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
+#| "condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-"
+#| "files</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+#| "<phrase condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+#| "<citerefentry> <refentrytitle>sssd-session-recording</refentrytitle> "
+#| "<manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_cache</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sss_debuglevel</"
+#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_obfuscate</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sss_seed</"
+#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle><manvolnum>8</"
+#| "manvolnum> </citerefentry>, <phrase condition=\"with_ssh\"> "
+#| "<citerefentry> <refentrytitle>sss_ssh_authorizedkeys</refentrytitle> "
+#| "<manvolnum>1</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</"
+#| "manvolnum> </citerefentry>, </phrase> <phrase condition=\"with_ifp\"> "
+#| "<citerefentry> <refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</"
+#| "manvolnum> </citerefentry>, </phrase> <citerefentry> "
+#| "<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> <phrase "
+#| "condition=\"with_stap\"> <citerefentry> <refentrytitle>sssd-systemtap</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> </phrase>"
 msgid ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
 "citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
@@ -22147,41 +22286,38 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sssd."
-"conf</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
+"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> </"
-"citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-"
-"attributes</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, "
-"<citerefentry> <refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</"
-"manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd-"
-"simple</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, "
-"<citerefentry> <refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</"
-"manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd-"
-"ad</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
-"condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-"
-"files</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> "
-"<phrase condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
+"citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-attributes</"
+"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</manvolnum> </"
+"citerefentry>, <citerefentry> <refentrytitle>sssd-simple</"
+"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</manvolnum> </"
+"citerefentry>, <citerefentry> <refentrytitle>sssd-ad</"
+"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
+"condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-files</"
+"refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> <phrase "
+"condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, </phrase> "
 "<citerefentry> <refentrytitle>sssd-session-recording</refentrytitle> "
 "<manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_cache</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> "
-"<refentrytitle>sss_debuglevel</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> "
+"citerefentry>, <citerefentry> <refentrytitle>sss_debuglevel</"
+"refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_obfuscate</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> "
-"<refentrytitle>sss_seed</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>, <citerefentry> "
+"citerefentry>, <citerefentry> <refentrytitle>sss_seed</"
+"refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle><manvolnum>8</"
 "manvolnum> </citerefentry>, <phrase condition=\"with_ssh\"> <citerefentry> "
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
@@ -22189,12 +22325,12 @@ msgstr ""
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
 "citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
 "<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> "
-"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
-"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
-"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
-"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
-"manvolnum> </citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
+"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
+"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
+"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
+"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
+"citerefentry> </phrase>"
 
 #. type: Content of: <listitem><para>
 #: include/ldap_search_bases.xml:3
@@ -22837,6 +22973,27 @@ msgstr ""
 "Anger om värdens och användarens huvudman skall göras kanonisk.  Denna "
 "funktion är tillgänglig med MIT Kerberos 1.7 och senare versioner."
 
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (heltal)"
+
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Antal gånger som tjänster skall försöka återansluta i händelse av en "
+#~ "dataleverantörskrasch eller -omstart innan de ger upp"
+
+#~ msgid ""
+#~ "This option specifies LDAP access control filter that the user must match "
+#~ "in order to be allowed access. Please note that the "
+#~ "<quote>access_provider</quote> option must be explicitly set to "
+#~ "<quote>ad</quote> in order for this option to have an effect."
+#~ msgstr ""
+#~ "Detta alternativ anger LDAP:s åtkomstkontrollfilter som användaren måste "
+#~ "matcha för att tillåtas åtkomst.  Observera att alternativet "
+#~ "<quote>access_provider</quote> måste vara uttryckligen satt till "
+#~ "<quote>ad</quote> för att detta alternativ skall ha någon effekt."
+
 #~ msgid ""
 #~ "<filename>sssd.conf</filename> must be a regular file that is owned, "
 #~ "readable, and writeable by '&sssd_user_name;' user (if SSSD is configured "
diff --git a/src/man/po/tg.po b/src/man/po/tg.po
index d13ca227fb7..7a7092cd040 100644
--- a/src/man/po/tg.po
+++ b/src/man/po/tg.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2014-12-15 12:10-0500\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Tajik (http://www.transifex.com/projects/p/sssd/language/"
@@ -209,13 +209,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Пешфарз: true"
 
@@ -232,11 +232,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr "Пешфарз: false"
@@ -269,8 +269,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -300,8 +300,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Пешфарз: 10"
 
@@ -337,46 +337,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "Пешфарз: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -387,19 +368,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -407,12 +388,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -420,70 +401,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -491,7 +472,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -499,52 +480,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -552,14 +533,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -569,17 +550,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -589,7 +570,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -602,8 +583,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -611,12 +592,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -626,7 +607,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -635,22 +616,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -658,12 +639,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -671,61 +652,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -733,12 +714,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -746,24 +727,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -772,12 +753,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -786,7 +767,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -794,58 +775,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -856,7 +837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -874,18 +855,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -893,12 +874,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -906,24 +887,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -931,7 +912,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -950,12 +931,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -964,22 +945,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -989,17 +970,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1009,19 +990,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 5400"
 msgid "Default: 60, KCM: 300"
 msgstr "Пешфарз: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1032,14 +1013,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1047,44 +1028,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1093,62 +1074,62 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 3600"
 msgstr "Пешфарз: 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 30"
 msgstr "Пешфарз: 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1160,58 +1141,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Пешфарз: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1219,7 +1200,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1229,7 +1210,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1238,17 +1219,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Пешфарз: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1256,17 +1237,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Пешфарз: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1274,17 +1255,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1293,7 +1274,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1302,41 +1283,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Пешфарз: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1344,23 +1325,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1368,47 +1349,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1416,113 +1397,113 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Пешфарз: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1530,25 +1511,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1556,19 +1537,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Пешфарз: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1576,12 +1557,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1590,12 +1571,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1606,45 +1587,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 #, fuzzy
 #| msgid "Default: true"
 msgid "Default: <quote>*</quote>"
 msgstr "Пешфарз: true"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1653,60 +1634,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Пешфарз: 0 (Номаҳдуд)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1714,59 +1695,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Пешфарз: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Пешфарз: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1775,51 +1756,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1830,23 +1811,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1854,7 +1835,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1863,17 +1844,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1881,31 +1862,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Пешфарз: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1915,75 +1897,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1991,19 +1973,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2011,46 +1993,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2058,34 +2040,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2095,7 +2077,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2103,59 +2085,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2163,7 +2145,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2175,63 +2157,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2239,12 +2221,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2255,7 +2237,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2263,7 +2245,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2271,7 +2253,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2280,47 +2262,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2329,30 +2311,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2360,7 +2342,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2368,22 +2350,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2391,19 +2373,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2411,7 +2393,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2426,7 +2408,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2434,45 +2416,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2480,7 +2462,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2488,17 +2470,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2509,24 +2491,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2536,22 +2518,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2559,51 +2541,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2612,12 +2594,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2627,7 +2609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2635,7 +2617,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2644,38 +2626,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2686,7 +2668,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2697,24 +2679,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2722,19 +2704,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2743,7 +2725,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2752,24 +2734,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2780,24 +2762,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2805,24 +2787,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2834,7 +2816,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2845,60 +2827,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2908,66 +2890,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2975,17 +2957,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -2993,7 +2975,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3002,57 +2984,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3062,12 +3044,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3076,14 +3058,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3092,38 +3074,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3132,24 +3114,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3158,36 +3140,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Пешфарз: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3201,14 +3183,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3217,14 +3199,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3232,32 +3214,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3266,19 +3248,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3289,139 +3271,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Пешфарз: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3430,17 +3412,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3452,18 +3434,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3474,7 +3456,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3483,12 +3465,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3496,19 +3478,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3517,17 +3499,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Пешфарз: 0 (номаҳдуд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3536,28 +3518,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3565,7 +3547,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3573,8 +3555,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3582,8 +3564,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3591,19 +3573,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3612,7 +3594,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3620,24 +3602,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3649,7 +3631,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3657,30 +3639,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3688,7 +3670,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3696,30 +3678,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3727,19 +3709,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3748,7 +3730,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3756,29 +3738,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3786,7 +3768,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3794,35 +3776,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3830,32 +3812,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3866,7 +3848,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3875,12 +3857,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3888,7 +3870,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3896,31 +3878,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3928,7 +3910,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3937,17 +3919,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3955,36 +3937,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3992,7 +3974,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4000,7 +3982,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4008,24 +3990,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4033,31 +4015,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4065,7 +4047,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4074,12 +4056,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4089,24 +4071,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4115,19 +4097,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4137,102 +4119,107 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Пешфарз: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4241,12 +4228,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4254,7 +4241,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4262,34 +4249,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Пешфарз: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4297,59 +4284,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "Пешфарз: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4357,31 +4344,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4389,104 +4376,104 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4494,27 +4481,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4524,34 +4511,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4560,19 +4547,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4580,12 +4567,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4597,7 +4584,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4609,7 +4596,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4617,42 +4604,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4661,7 +4648,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4672,7 +4659,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4680,38 +4667,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: match"
 msgstr "Пешфарз: 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4720,24 +4707,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4747,14 +4734,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4762,21 +4749,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4784,7 +4771,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4793,7 +4780,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4802,7 +4789,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4810,17 +4797,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4828,12 +4815,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4841,12 +4828,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4854,12 +4841,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4868,12 +4855,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4881,19 +4868,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4910,7 +4897,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4918,17 +4905,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4937,7 +4924,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4947,7 +4934,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -4967,12 +4954,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -4983,69 +4970,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5058,7 +5045,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5066,7 +5053,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5075,55 +5062,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5132,17 +5119,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5150,26 +5137,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5178,17 +5165,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5198,7 +5185,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5207,59 +5194,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5268,7 +5255,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5276,18 +5263,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5295,46 +5293,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5343,7 +5341,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5351,12 +5349,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5385,7 +5383,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5394,7 +5392,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5402,7 +5400,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5413,7 +5411,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5424,7 +5422,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5586,7 +5584,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Намунаҳо:"
@@ -5998,7 +5996,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6251,7 +6249,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6268,36 +6266,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6305,12 +6304,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6318,12 +6317,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6331,17 +6330,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6352,24 +6351,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6380,12 +6379,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6398,7 +6397,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6410,17 +6409,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6428,49 +6427,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Пешфарз: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6478,28 +6477,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6511,7 +6510,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6519,7 +6518,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6527,39 +6526,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6569,7 +6568,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6577,26 +6576,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6605,7 +6604,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6613,31 +6612,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6650,51 +6649,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6703,12 +6702,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6724,12 +6723,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Намуна:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6738,14 +6737,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6754,24 +6753,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6779,19 +6778,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6800,7 +6799,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6808,7 +6807,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6817,7 +6816,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6825,22 +6824,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6850,14 +6849,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6870,12 +6869,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6885,81 +6884,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -6968,74 +6968,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7046,7 +7046,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7054,64 +7054,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7125,12 +7141,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7138,43 +7154,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7182,14 +7198,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7199,19 +7215,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7219,7 +7235,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7227,106 +7243,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7335,59 +7351,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7396,22 +7412,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7420,14 +7436,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "НАМУНА"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7435,7 +7451,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7448,27 +7464,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7484,13 +7500,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "ЭЗОҲҲО"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9729,7 +9745,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9744,7 +9760,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9759,12 +9775,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9785,12 +9801,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9814,17 +9830,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9832,17 +9848,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9850,7 +9866,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9877,7 +9893,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9890,12 +9906,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9909,7 +9925,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9921,60 +9937,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10122,26 +10138,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10160,7 +10176,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10875,14 +10891,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10891,7 +10909,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10900,14 +10918,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10920,7 +10938,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10929,7 +10947,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10947,24 +10965,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -10973,7 +10991,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -10982,12 +11000,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -10997,7 +11015,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11006,7 +11024,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11015,7 +11033,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11025,21 +11043,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11049,7 +11067,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11064,23 +11082,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11088,22 +11106,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11114,7 +11132,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11122,74 +11140,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11199,12 +11217,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11212,12 +11230,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11233,14 +11251,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11248,7 +11266,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11260,42 +11278,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11311,7 +11329,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11319,7 +11337,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11327,7 +11345,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11339,22 +11357,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11370,7 +11388,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11378,7 +11396,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11386,7 +11404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11398,22 +11416,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11428,14 +11446,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11443,7 +11461,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11455,23 +11473,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11487,14 +11505,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11502,7 +11520,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11513,19 +11531,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11533,7 +11551,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11545,29 +11563,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11575,12 +11593,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11593,52 +11611,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11646,17 +11664,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11666,17 +11684,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11685,12 +11703,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11701,12 +11719,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11717,7 +11735,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11732,7 +11750,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11744,7 +11762,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11755,19 +11773,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11777,7 +11795,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11785,7 +11803,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11800,7 +11818,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11809,7 +11827,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11817,7 +11835,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11827,7 +11845,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12310,74 +12328,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14172,7 +14203,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14193,8 +14224,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17863,14 +17943,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>
diff --git a/src/man/po/uk.po b/src/man/po/uk.po
index 32c30cd3618..0311507f1db 100644
--- a/src/man/po/uk.po
+++ b/src/man/po/uk.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2024-06-27 05:36+0000\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <https://translate.fedoraproject.org/projects/sssd/"
@@ -264,15 +264,13 @@ msgstr ""
 "проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358 sssd.conf.5.xml:710
-#: sssd.conf.5.xml:725 sssd.conf.5.xml:948 sssd.conf.5.xml:1066
-#: sssd.conf.5.xml:2194
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr "Типове значення: true"
 
@@ -292,14 +290,12 @@ msgstr ""
 "journald, цей параметр буде проігноровано."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
-#: sssd.conf.5.xml:648 sssd.conf.5.xml:945 sssd.conf.5.xml:2097
-#: sssd.conf.5.xml:2164 sssd.conf.5.xml:4250
 msgid "Default: false"
 msgstr "Типове значення: false"
 
@@ -339,8 +335,8 @@ msgstr ""
 "встановлення цього значення не впливає на інші типи журналювання)."
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -374,9 +370,8 @@ msgstr ""
 "самостійно."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
-#: sssd.conf.5.xml:1286 sssd.conf.5.xml:1763 sssd.conf.5.xml:4266
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr "Типове значення: 10"
 
@@ -415,12 +410,18 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
-msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#, fuzzy
+#| msgid ""
+#| "Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</"
+#| "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+#| "condition=\"with_ssh\">, ssh</phrase> <phrase "
+#| "condition=\"with_pac_responder\">, pac</phrase> <phrase "
+#| "condition=\"with_ifp\">, ifp</phrase>"
+msgid ""
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 "Підтримувані служби: nss, pam <phrase condition=\"with_sudo\">, sudo</"
 "phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
@@ -429,7 +430,7 @@ msgstr ""
 "condition=\"with_ifp\">, ifp</phrase>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
@@ -439,34 +440,13 @@ msgstr ""
 "має увімкнути дозволені до використання служби за допомогою такої команди: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782 sssd.conf.5.xml:780
-msgid "reconnection_retries (integer)"
-msgstr "reconnection_retries (ціле число)"
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785 sssd.conf.5.xml:783
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-"Кількість повторних спроб встановлення зв’язку зі службами або їх "
-"перезапуску у разі аварійного завершення роботи інструменту надання даних до "
-"визнання подальших спроб безнадійними."
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100 sssd.conf.5.xml:788 sssd.conf.5.xml:3722
-msgid "Default: 3"
-msgstr "Типове значення: 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr "domains"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -484,12 +464,12 @@ msgstr ""
 "використовувати символ «/»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562 sssd.conf.5.xml:3554
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr "re_expression (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
@@ -498,7 +478,7 @@ msgstr ""
 "користувача і доменом на його частини."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -510,12 +490,12 @@ msgstr ""
 "ДОМЕНІВ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619 sssd.conf.5.xml:3611
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr "full_name_format (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622 sssd.conf.5.xml:3614
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -527,32 +507,32 @@ msgstr ""
 "домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633 sssd.conf.5.xml:3625
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr "%1$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634 sssd.conf.5.xml:3626
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr "ім’я користувача"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637 sssd.conf.5.xml:3629
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr "%2$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640 sssd.conf.5.xml:3632
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr "назва домену у форматі, вказаному у файлі налаштувань SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646 sssd.conf.5.xml:3638
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr "%3$s"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649 sssd.conf.5.xml:3641
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
@@ -561,7 +541,7 @@ msgstr ""
 "Directory, налаштованих та автоматично виявлених за зв’язками довіри IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -570,7 +550,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
@@ -579,12 +559,12 @@ msgstr ""
 "про ці рядки можна дізнатися з довідки до РОЗДІЛІВ ДОМЕНІВ."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr "monitor_resolv_conf (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
@@ -593,12 +573,12 @@ msgstr ""
 "моменту, коли слід оновити дані вбудованого інструмента визначення DNS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr "try_inotify (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -609,7 +589,7 @@ msgstr ""
 "виконуватиметься опитування resolv.conf кожні п’ять секунд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -619,7 +599,7 @@ msgstr ""
 "рідкісних випадках слід встановити для цього параметра значення «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
@@ -628,7 +608,7 @@ msgstr ""
 "інших платформах."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
@@ -638,12 +618,12 @@ msgstr ""
 "опитування файла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr "krb5_rcache_dir (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
@@ -652,7 +632,7 @@ msgstr ""
 "Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
@@ -662,7 +642,7 @@ msgstr ""
 "для кешу відтворення."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
@@ -671,12 +651,12 @@ msgstr ""
 "(__LIBKRB5_DEFAULTS__, якщо не вказано)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr "user (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -687,7 +667,7 @@ msgstr ""
 "підтримуваним значенням є «&sssd_user_name;»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
@@ -696,7 +676,7 @@ msgstr ""
 "запущено від імені користувача, відмінного від root (бажаний спосіб)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -712,17 +692,17 @@ msgstr ""
 "«&sssd_user_name;», або від імені «root»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr "Типове значення: не встановлено, процес буде запущено від імені root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr "default_domain_suffix (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -738,7 +718,7 @@ msgstr ""
 "лише імені користувача без додавання до нього назви домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -762,8 +742,8 @@ msgstr ""
 "default_domain_suffix.</phrase>"
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -771,12 +751,12 @@ msgid "Default: not set"
 msgstr "Типове значення: not set"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr "override_space (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -791,7 +771,7 @@ msgstr ""
 "через типовий роздільник полів у оболонці."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -804,22 +784,22 @@ msgstr ""
 "але, загалом, результат пошуку буде невизначеним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr "Типове значення: не встановлено (пробіли не замінятимуться)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr "certificate_verification (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr "no_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -830,12 +810,12 @@ msgstr ""
 "у сертифікаті, є недоступними з клієнта."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr "soft_ocsp"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -847,12 +827,12 @@ msgstr ""
 "недоступним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr "ocsp_dgst"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
@@ -861,39 +841,39 @@ msgstr ""
 "створення ідентифікатора сертифіката для запиту OCSP. Можливі значення:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr "sha1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr "sha256"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr "sha384"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr "sha512"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 "Типове значення: sha1 (для уможливлення сумісності із відповідачем, який є "
 "сумісним із RFC5019)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr "no_verification"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
@@ -902,12 +882,12 @@ msgstr ""
 "тестування."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr "partial_chain"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -919,12 +899,12 @@ msgstr ""
 "бути не самопідписаним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr "ocsp_default_responder=URL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -935,12 +915,12 @@ msgstr ""
 "відповідача, наприклад http://example.com:80/ocsp."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr "ocsp_default_responder_signing_cert=НАЗВА"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
@@ -949,12 +929,12 @@ msgstr ""
 "мають бути у файлі PEM, який вказано параметром pam_cert_db_path."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr "crl_file=/ШЛЯХ/ДО/ФАЙЛА/CRL"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -967,12 +947,12 @@ msgstr ""
 "manvolnum> </citerefentry>, щоб дізнатися більше."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr "soft_crl"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -985,7 +965,7 @@ msgstr ""
 "автономному режимі, коли оновлення CRL є неможливим."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -996,26 +976,26 @@ msgstr ""
 "параметри: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614 sssd.conf.5.xml:612
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 "Обробник параметрів повідомлятиме про невідомі параметри і просто "
 "ігноруватиме їх."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617 sssd.conf.5.xml:615
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 "Типове значення: не встановлено, тобто перевірка сертифікатів нічим не "
 "обмежуватиметься"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623 sssd.conf.5.xml:621
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr "disable_netlink (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626 sssd.conf.5.xml:624
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
@@ -1024,7 +1004,7 @@ msgstr ""
 "адресах, посилання та виконання певних дій."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631 sssd.conf.5.xml:629
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
@@ -1033,17 +1013,17 @@ msgstr ""
 "можна вимкнути встановленням для цього параметра значення «true»"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636 sssd.conf.5.xml:634
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr "Типове значення: false (виявлення змін у netlink)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641 sssd.conf.5.xml:639
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr "enable_files_domain (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644 sssd.conf.5.xml:642
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
@@ -1052,12 +1032,12 @@ msgstr ""
 "<quote>id_provider=files</quote> до усіх явним чином налаштованих доменів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655 sssd.conf.5.xml:653
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr "domain_resolution_order"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658 sssd.conf.5.xml:656
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -1074,7 +1054,7 @@ msgstr ""
 "відбуватиметься у випадковому порядку для кожного батьківського домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670 sssd.conf.5.xml:668
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -1107,19 +1087,18 @@ msgstr ""
 "різних доменах можуть бути однаковими."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341 sssd.conf.5.xml:696
-#: sssd.conf.5.xml:1787 sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr "Типове значення: не встановлено"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703 sssd.conf.5.xml:701
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr "implicit_pac_responder (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706 sssd.conf.5.xml:704
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -1130,12 +1109,12 @@ msgstr ""
 "цього параметра значення «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717 sssd.conf.5.xml:715
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr "core_dumpable (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720 sssd.conf.5.xml:718
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -1148,17 +1127,17 @@ msgstr ""
 "більше."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732 sssd.conf.5.xml:730
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr "passkey_verification (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740 sssd.conf.5.xml:738
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr "user_verification (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742 sssd.conf.5.xml:740
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
@@ -1167,7 +1146,7 @@ msgstr ""
 "розпізнавання. Якщо увімкнено, програма завжди надсилатиме запит щодо PIN."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748 sssd.conf.5.xml:746
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -1178,7 +1157,7 @@ msgstr ""
 "перезаписано сервером."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735 sssd.conf.5.xml:733
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -1205,12 +1184,12 @@ msgstr ""
 "профілів.  <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767 sssd.conf.5.xml:765
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "РОЗДІЛИ СЛУЖБ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769 sssd.conf.5.xml:767
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -1223,22 +1202,22 @@ msgstr ""
 "у розділі <quote>[nss]</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776 sssd.conf.5.xml:774
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "Загальні параметри налаштування служб"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778 sssd.conf.5.xml:776
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "Цими параметрами можна скористатися для налаштування будь-яких служб."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795 sssd.conf.5.xml:793
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr "fd_limit"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798 sssd.conf.5.xml:796
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -1254,17 +1233,17 @@ msgstr ""
 "цього параметра і обмеженням \"hard\" у limits.conf."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807 sssd.conf.5.xml:805
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr "Типове значення: 8192 (або обмеження у limits.conf \"hard\")"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812 sssd.conf.5.xml:810
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr "client_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815 sssd.conf.5.xml:813
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1280,17 +1259,17 @@ msgstr ""
 "до 10 секунд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824 sssd.conf.5.xml:822
+#: sssd.conf.5.xml:797
 msgid "Default: 60, KCM: 300"
 msgstr "Типове значення: 60, KCM: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829 sssd.conf.5.xml:827
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr "offline_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832 sssd.conf.5.xml:830
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1308,8 +1287,7 @@ msgstr ""
 "із мережею нове значення обчислюється за такою формулою:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899 sssd.conf.5.xml:841
-#: sssd.conf.5.xml:897
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
@@ -1318,7 +1296,7 @@ msgstr ""
 "offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846 sssd.conf.5.xml:844
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1329,7 +1307,7 @@ msgstr ""
 "є 30. Кінцевий результат є кількістю секунд до наступної повторної спроби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852 sssd.conf.5.xml:850
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
@@ -1338,19 +1316,18 @@ msgstr ""
 "offline_timeout_max (окрім випадкової частини)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495 sssd.conf.5.xml:854
-#: sssd.conf.5.xml:1197 sssd.conf.5.xml:1580 sssd.conf.5.xml:1876
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr "Типове значення: 60"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861 sssd.conf.5.xml:859
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr "offline_timeout_max (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864 sssd.conf.5.xml:862
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
@@ -1359,12 +1336,12 @@ msgstr ""
 "з'єднання із мережею після неуспішних спроби відновити з'єднання."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869 sssd.conf.5.xml:867
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr "Значення 0 вимикає збільшення проміжку часу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872 sssd.conf.5.xml:870
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
@@ -1373,7 +1350,7 @@ msgstr ""
 "параметра offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876 sssd.conf.5.xml:874
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1387,7 +1364,7 @@ msgstr ""
 "offline_timeout_max, яке є принаймні учетверо більшим за offline_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882 sssd.conf.5.xml:880
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
@@ -1396,17 +1373,17 @@ msgstr ""
 "стане перевизначення значення offline_timeout, тому не варто цього робити."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887 sssd.conf.5.xml:885
+#: sssd.conf.5.xml:860
 msgid "Default: 3600"
 msgstr "Типове значення: 3600"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892 sssd.conf.5.xml:890
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr "offline_timeout_random_offset (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895 sssd.conf.5.xml:893
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
@@ -1415,7 +1392,7 @@ msgstr ""
 "обробників із вказаними інтервалами часу:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902 sssd.conf.5.xml:900
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
@@ -1425,27 +1402,27 @@ msgstr ""
 "числом у такому діапазоні:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907 sssd.conf.5.xml:905
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr "[0 - offline_timeout_random_offset]"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910 sssd.conf.5.xml:908
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr "Значення 0 призводить до вимикання додавання випадкового зсуву."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913 sssd.conf.5.xml:911
+#: sssd.conf.5.xml:886
 msgid "Default: 30"
 msgstr "Типове значення: 30"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918 sssd.conf.5.xml:916
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr "responder_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921 sssd.conf.5.xml:919
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1464,19 +1441,18 @@ msgstr ""
 "і якщо служби активуються за допомогою або сокетів або D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
-#: sssd-ldap.5.xml:332 sssd.conf.5.xml:933 sssd.conf.5.xml:1210
-#: sssd.conf.5.xml:2329
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
+#: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr "Типове значення: 300"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940 sssd.conf.5.xml:938
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr "cache_first"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943 sssd.conf.5.xml:941
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
@@ -1485,12 +1461,12 @@ msgstr ""
 "запису до модулів засобів надання даних."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958 sssd.conf.5.xml:956
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr "Параметри налаштування NSS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960 sssd.conf.5.xml:958
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
@@ -1498,12 +1474,12 @@ msgstr ""
 "Switch (NSS або перемикання служби визначення назв)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965 sssd.conf.5.xml:963
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr "enum_cache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968 sssd.conf.5.xml:966
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
@@ -1512,17 +1488,17 @@ msgstr ""
 "кеші nss_sss у секундах"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972 sssd.conf.5.xml:970
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr "Типове значення: 120"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977 sssd.conf.5.xml:975
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr "entry_cache_nowait_percentage (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980 sssd.conf.5.xml:978
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1533,7 +1509,7 @@ msgstr ""
 "entry_cache_timeout для домену період часу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986 sssd.conf.5.xml:984
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1548,7 +1524,7 @@ msgstr ""
 "розблокування після оновлення кешу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996 sssd.conf.5.xml:994
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1562,18 +1538,17 @@ msgstr ""
 "можливість."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120 sssd.conf.5.xml:1002
-#: sssd.conf.5.xml:2118
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr "Типове значення: 50"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009 sssd.conf.5.xml:1007
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr "entry_negative_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012 sssd.conf.5.xml:1010
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1584,18 +1559,17 @@ msgstr ""
 "даних, зокрема неіснуючих) перед повторним запитом до сервера обробки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
-#: sssd.conf.5.xml:1016 sssd.conf.5.xml:1775 sssd.conf.5.xml:2142
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr "Типове значення: 15"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023 sssd.conf.5.xml:1021
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr "local_negative_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026 sssd.conf.5.xml:1024
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1607,17 +1581,17 @@ msgstr ""
 "цю можливість."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032 sssd.conf.5.xml:1030
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr "Типове значення: 14400 (4 години)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037 sssd.conf.5.xml:1035
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr "filter_users, filter_groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040 sssd.conf.5.xml:1038
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1632,7 +1606,7 @@ msgstr ""
 "реєстраційного запису користувача (UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048 sssd.conf.5.xml:1046
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1646,17 +1620,17 @@ msgstr ""
 "відфільтрованої групи."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056 sssd.conf.5.xml:1054
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr "Типове значення: root"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061 sssd.conf.5.xml:1059
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr "filter_users_in_groups (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064 sssd.conf.5.xml:1062
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
@@ -1664,12 +1638,12 @@ msgstr ""
 "встановіть для цього параметра значення «false»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075 sssd.conf.5.xml:1073
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr "fallback_homedir (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078 sssd.conf.5.xml:1076
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
@@ -1678,7 +1652,7 @@ msgstr ""
 "каталог не вказано явним чином засобом надання даних домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083 sssd.conf.5.xml:1081
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
@@ -1686,7 +1660,7 @@ msgstr ""
 "для параметра override_homedir."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089 sssd.conf.5.xml:1087
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1696,27 +1670,25 @@ msgstr ""
 "                            "
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
-#: sssd.conf.5.xml:1085 sssd.conf.5.xml:1647 sssd.conf.5.xml:1666
-#: sssd.conf.5.xml:1743
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "приклад: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093 sssd.conf.5.xml:1091
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 "Типове значення: не встановлено (без замін для невстановлених домашніх "
 "каталогів)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099 sssd.conf.5.xml:1097
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr "override_shell (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102 sssd.conf.5.xml:1100
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1728,19 +1700,19 @@ msgstr ""
 "або для кожного з доменів окремо."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108 sssd.conf.5.xml:1106
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 "Типове значення: не встановлено (SSSD використовуватиме значення, отримане "
 "від LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114 sssd.conf.5.xml:1112
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr "allowed_shells (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117 sssd.conf.5.xml:1115
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
@@ -1748,13 +1720,13 @@ msgstr ""
 "визначення оболонки є таким:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120 sssd.conf.5.xml:1118
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 "1. Якщо оболонку вказано у <quote>/etc/shells</quote>, її буде використано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124 sssd.conf.5.xml:1122
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
@@ -1764,7 +1736,7 @@ msgstr ""
 "shell_fallback."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129 sssd.conf.5.xml:1127
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
@@ -1773,14 +1745,14 @@ msgstr ""
 "<quote>/etc/shells</quote>, буде використано оболонку nologin."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134 sssd.conf.5.xml:1132
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 "Для визначення будь-якої командної оболонки можна скористатися шаблоном "
 "заміни (*)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137 sssd.conf.5.xml:1135
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1792,12 +1764,12 @@ msgstr ""
 "справою."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144 sssd.conf.5.xml:1142
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr "Порожній рядок оболонки буде передано без обробки до libc."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147 sssd.conf.5.xml:1145
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
@@ -1806,29 +1778,29 @@ msgstr ""
 "тобто у разі встановлення нової оболонки слід перезапустити SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151 sssd.conf.5.xml:1149
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 "Типове значення: не встановлено. Автоматично використовується оболонка "
 "користувача."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156 sssd.conf.5.xml:1154
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr "vetoed_shells (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159 sssd.conf.5.xml:1157
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr "Замінити всі записи цих оболонок на shell_fallback"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164 sssd.conf.5.xml:1162
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr "shell_fallback (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167 sssd.conf.5.xml:1165
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
@@ -1836,17 +1808,17 @@ msgstr ""
 "системі не встановлено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171 sssd.conf.5.xml:1169
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr "Типове значення: /bin/sh"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176 sssd.conf.5.xml:1174
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr "default_shell"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179 sssd.conf.5.xml:1177
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
@@ -1856,7 +1828,7 @@ msgstr ""
 "або на загальному рівні у розділі [nss], або окремо для кожного з доменів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185 sssd.conf.5.xml:1183
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
@@ -1866,14 +1838,12 @@ msgstr ""
 "зазвичай /bin/sh)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575 sssd.conf.5.xml:1190
-#: sssd.conf.5.xml:1573
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr "get_domains_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578 sssd.conf.5.xml:1193
-#: sssd.conf.5.xml:1576
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
@@ -1882,12 +1852,12 @@ msgstr ""
 "чинним."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204 sssd.conf.5.xml:1202
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr "memcache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207 sssd.conf.5.xml:1205
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
@@ -1897,7 +1867,7 @@ msgstr ""
 "пам'яті."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215 sssd.conf.5.xml:1213
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
@@ -1906,10 +1876,8 @@ msgstr ""
 "варто користуватися лише для тестування."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323 sssd.conf.5.xml:1219
-#: sssd.conf.5.xml:1244 sssd.conf.5.xml:1269 sssd.conf.5.xml:1294
-#: sssd.conf.5.xml:1321
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
@@ -1919,12 +1887,12 @@ msgstr ""
 "пам’яті."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229 sssd.conf.5.xml:1227
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr "memcache_size_passwd (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232 sssd.conf.5.xml:1230
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1934,15 +1902,13 @@ msgstr ""
 "для запитів passwd. Встановлення розміру 0 вимкне кеш у пам'яті для passwd."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
-#: sssd.conf.5.xml:1236 sssd.conf.5.xml:2982
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr "Типове значення: 8"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
-#: sssd.conf.5.xml:1289 sssd.conf.5.xml:1316
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
@@ -1951,12 +1917,12 @@ msgstr ""
 "значно погіршити швидкодію SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254 sssd.conf.5.xml:1252
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr "memcache_size_group (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257 sssd.conf.5.xml:1255
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1966,20 +1932,19 @@ msgstr ""
 "для запитів group. Встановлення розміру 0 вимкне кеш у пам'яті для group."
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
-#: include/krb5_options.xml:11 sssd.conf.5.xml:1261 sssd.conf.5.xml:1313
-#: sssd.conf.5.xml:3743
+#: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr "Типове значення: 6"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279 sssd.conf.5.xml:1277
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr "memcache_size_initgroups (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282 sssd.conf.5.xml:1280
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1990,12 +1955,12 @@ msgstr ""
 "initgroups."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304 sssd.conf.5.xml:1302
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr "memcache_size_sid (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307 sssd.conf.5.xml:1305
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -2008,12 +1973,12 @@ msgstr ""
 "0 вимкне кеш у пам'яті для SID."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90 sssd.conf.5.xml:1329
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr "user_attributes (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334 sssd.conf.5.xml:1332
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -2030,7 +1995,7 @@ msgstr ""
 "manvolnum> </citerefentry>, щоб дізнатися більше), але без типових значень."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347 sssd.conf.5.xml:1345
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
@@ -2039,19 +2004,19 @@ msgstr ""
 "на те, чи не встановлено його для відповідача NSS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352 sssd.conf.5.xml:1350
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 "Типове значення: не встановлено, резервне значення визначається за "
 "параметром InfoPipe"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357 sssd.conf.5.xml:1355
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr "pwfield (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360 sssd.conf.5.xml:1358
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
@@ -2060,12 +2025,12 @@ msgstr ""
 "груп, для поля <quote>password</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365 sssd.conf.5.xml:1363
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr "Типове значення: <quote>*</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368 sssd.conf.5.xml:1366
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
@@ -2075,7 +2040,7 @@ msgstr ""
 "розділі [nss]."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1370
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -2088,12 +2053,12 @@ msgstr ""
 "shadowutils)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384 sssd.conf.5.xml:1382
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr "Параметри налаштування PAM"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386 sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
@@ -2102,12 +2067,12 @@ msgstr ""
 "Authentication Module (PAM або блокового модуля розпізнавання)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391 sssd.conf.5.xml:1389
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr "offline_credentials_expiration (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394 sssd.conf.5.xml:1392
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
@@ -2117,18 +2082,17 @@ msgstr ""
 "входу до системи)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412 sssd.conf.5.xml:1397
-#: sssd.conf.5.xml:1410
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr "Типове значення: 0 (без обмежень)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1403
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr "offline_failed_login_attempts (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408 sssd.conf.5.xml:1406
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
@@ -2137,12 +2101,12 @@ msgstr ""
 "дозволену кількість спроб входу з визначенням помилкового пароля."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418 sssd.conf.5.xml:1416
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr "offline_failed_login_delay (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421 sssd.conf.5.xml:1419
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
@@ -2152,7 +2116,7 @@ msgstr ""
 "системи."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426 sssd.conf.5.xml:1424
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -2164,18 +2128,17 @@ msgstr ""
 "увімкнути можливість автономного розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542 sssd.conf.5.xml:1430
-#: sssd.conf.5.xml:1540
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr "Типове значення: 5"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438 sssd.conf.5.xml:1436
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr "pam_verbosity (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441 sssd.conf.5.xml:1439
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
@@ -2184,43 +2147,43 @@ msgstr ""
 "розпізнавання. Чим більшим є значення, тим більше повідомлень буде показано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446 sssd.conf.5.xml:1444
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr "У поточній версії sssd передбачено підтримку таких значень:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449 sssd.conf.5.xml:1447
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr "<emphasis>0</emphasis>: не показувати жодних повідомлень"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452 sssd.conf.5.xml:1450
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr "<emphasis>1</emphasis>: показувати лише важливі повідомлення"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456 sssd.conf.5.xml:1454
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr "<emphasis>2</emphasis>: показувати всі інформаційні повідомлення"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459 sssd.conf.5.xml:1457
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 "<emphasis>3</emphasis>: показувати всі повідомлення та діагностичні дані"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63 sssd.conf.5.xml:1461
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr "Типове значення: 1"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469 sssd.conf.5.xml:1467
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr "pam_response_filter (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472 sssd.conf.5.xml:1470
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -2234,7 +2197,7 @@ msgstr ""
 "встановлювати за допомогою pam_sss."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480 sssd.conf.5.xml:1478
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
@@ -2244,37 +2207,37 @@ msgstr ""
 "повідомлень."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487 sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr "ENV"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488 sssd.conf.5.xml:1486
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr "Не надсилати жодних змінних середовища до жодної служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491 sssd.conf.5.xml:1489
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr "ENV:назва_змінної"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492 sssd.conf.5.xml:1490
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr "Не надсилати змінної середовища назва_змінної до жодної служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496 sssd.conf.5.xml:1494
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr "ENV:назва_змінної:служба"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497 sssd.conf.5.xml:1495
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr "Не надсилати змінної середовища назва_змінної до вказаної служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485 sssd.conf.5.xml:1483
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -2283,7 +2246,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504 sssd.conf.5.xml:1502
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -2301,23 +2264,23 @@ msgstr ""
 "Змішування стилів вважається помилкою."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515 sssd.conf.5.xml:1513
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr "Типове значення: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518 sssd.conf.5.xml:1516
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr "Приклад: -ENV:KRB5CCNAME:sudo-i вилучає фільтр зі списку типових"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525 sssd.conf.5.xml:1523
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr "pam_id_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528 sssd.conf.5.xml:1526
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -2328,7 +2291,7 @@ msgstr ""
 "що розпізнавання виконується на основі найсвіжіших даних."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534 sssd.conf.5.xml:1532
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -2342,19 +2305,18 @@ msgstr ""
 "надання даних профілів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548 sssd.conf.5.xml:1546
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr "pam_pwd_expiration_warning (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014 sssd.conf.5.xml:1549
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 "Показати попередження за вказану кількість днів перед завершенням дії пароля."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554 sssd.conf.5.xml:1552
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -2365,8 +2327,7 @@ msgstr ""
 "попередження."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017 sssd.conf.5.xml:1558
-#: sssd.conf.5.xml:3009
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
@@ -2376,7 +2337,7 @@ msgstr ""
 "буде автоматично показано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565 sssd.conf.5.xml:1563
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
@@ -2385,18 +2346,18 @@ msgstr ""
 "<emphasis>pwd_expiration_warning</emphasis> для окремого домену."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
-#: sssd.conf.5.xml:1568 sssd.conf.5.xml:4009
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr "Типове значення: 0"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587 sssd.conf.5.xml:1585
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr "pam_trusted_users (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590 sssd.conf.5.xml:1588
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -2412,13 +2373,13 @@ msgstr ""
 "під час запуску системи."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600 sssd.conf.5.xml:1598
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 "Типове значення: типово усі користувачі вважаються надійними (довіреними)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604 sssd.conf.5.xml:1602
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
@@ -2427,12 +2388,12 @@ msgstr ""
 "відповідача PAM, навіть якщо користувача немає у списку pam_trusted_users."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611 sssd.conf.5.xml:1609
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr "pam_public_domains (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614 sssd.conf.5.xml:1612
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
@@ -2441,12 +2402,12 @@ msgstr ""
 "отримувати навіть ненадійні користувачі."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618 sssd.conf.5.xml:1616
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr "Визначено два спеціальних значення параметра pam_public_domains:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622 sssd.conf.5.xml:1620
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
@@ -2454,7 +2415,7 @@ msgstr ""
 "PAM.)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626 sssd.conf.5.xml:1624
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
@@ -2463,21 +2424,19 @@ msgstr ""
 "відповідачі.)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209 sssd.conf.5.xml:1628 sssd.conf.5.xml:1653
-#: sssd.conf.5.xml:1672 sssd.conf.5.xml:1909 sssd.conf.5.xml:2744
-#: sssd.conf.5.xml:3938
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr "Типове значення: none"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635 sssd.conf.5.xml:1633
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr "pam_account_expired_message (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638 sssd.conf.5.xml:1636
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
@@ -2486,7 +2445,7 @@ msgstr ""
 "замінити типове повідомлення «Доступ заборонено» («Permission denied»)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
@@ -2496,7 +2455,7 @@ msgstr ""
 "(показувати усі повідомлення і діагностичні дані)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651 sssd.conf.5.xml:1649
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -2506,12 +2465,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660 sssd.conf.5.xml:1658
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr "pam_account_locked_message (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663 sssd.conf.5.xml:1661
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
@@ -2520,7 +2479,7 @@ msgstr ""
 "типове повідомлення «Доступ заборонено» («Permission denied»)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670 sssd.conf.5.xml:1668
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2530,47 +2489,46 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679 sssd.conf.5.xml:1677
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr "pam_passkey_auth (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682 sssd.conf.5.xml:1680
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr "Увімкнути розпізнавання на основі пристрою ключа."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
-#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145 sssd.conf.5.xml:1683
-#: sssd.conf.5.xml:1995
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
+#: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr "Типове значення: True"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690 sssd.conf.5.xml:1688
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr "passkey_debug_libfido2 (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693 sssd.conf.5.xml:1691
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr "Увімкнути діагностичні повідомлення бібліотеки libfido2."
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
-#: include/ldap_id_mapping.xml:250 sssd.conf.5.xml:1694 sssd.conf.5.xml:1708
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
+#: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr "Типове значення: False"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701 sssd.conf.5.xml:1699
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr "pam_cert_auth (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704 sssd.conf.5.xml:1702
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2581,24 +2539,22 @@ msgstr ""
 "розпізнавання, типово таку сертифікацію вимкнено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715 sssd.conf.5.xml:1713
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr "pam_cert_db_path (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718 sssd.conf.5.xml:1716
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr "Шлях до бази даних сертифікатів."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
-#: sssd.conf.5.xml:1719 sssd.conf.5.xml:2244 sssd.conf.5.xml:4430
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr "Типове значення:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248 sssd.conf.5.xml:1721
-#: sssd.conf.5.xml:2246
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
@@ -2607,12 +2563,12 @@ msgstr ""
 "служб сертифікації у форматі PEM)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733 sssd.conf.5.xml:1731
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr "pam_cert_verification (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736 sssd.conf.5.xml:1734
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2627,7 +2583,7 @@ msgstr ""
 "<quote>certificate_verification</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747 sssd.conf.5.xml:1745
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2637,7 +2593,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751 sssd.conf.5.xml:1749
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
@@ -2647,24 +2603,24 @@ msgstr ""
 "<quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758 sssd.conf.5.xml:1756
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr "p11_child_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761 sssd.conf.5.xml:1759
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 "Час у секундах, протягом якого pam_sss очікуватиме на завершення роботи "
 "p11_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770 sssd.conf.5.xml:1768
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr "passkey_child_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773 sssd.conf.5.xml:1771
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
@@ -2672,12 +2628,12 @@ msgstr ""
 "роботи passkey_child."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782 sssd.conf.5.xml:1780
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr "pam_app_services (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785 sssd.conf.5.xml:1783
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
@@ -2686,12 +2642,12 @@ msgstr ""
 "типу <quote>application</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794 sssd.conf.5.xml:1792
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr "pam_p11_allowed_services (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797 sssd.conf.5.xml:1795
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
@@ -2700,7 +2656,7 @@ msgstr ""
 "використання смарткарток."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812 sssd.conf.5.xml:1810
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2710,7 +2666,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801 sssd.conf.5.xml:1799
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2729,64 +2685,64 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947 sssd.conf.5.xml:1814
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 "Типове значення: типовий набір назв служб PAM складається з таких значень:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648 sssd.conf.5.xml:1819
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr "login"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653 sssd.conf.5.xml:1824
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr "su"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658 sssd.conf.5.xml:1829
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr "su-l"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673 sssd.conf.5.xml:1834
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr "gdm-smartcard"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668 sssd.conf.5.xml:1839
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr "gdm-password"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678 sssd.conf.5.xml:1844
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr "kdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956 sssd.conf.5.xml:1849
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr "sudo"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961 sssd.conf.5.xml:1854
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr "sudo-i"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861 sssd.conf.5.xml:1859
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr "gnome-screensaver"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869 sssd.conf.5.xml:1867
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr "p11_wait_for_card_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872 sssd.conf.5.xml:1870
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2797,12 +2753,12 @@ msgstr ""
 "має чекати на вставлення смарткартки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883 sssd.conf.5.xml:1881
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr "p11_uri (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886 sssd.conf.5.xml:1884
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2821,7 +2777,7 @@ msgstr ""
 "слід використовувати вказаний зчитувач."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899 sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2831,7 +2787,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903 sssd.conf.5.xml:1901
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2841,7 +2797,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897 sssd.conf.5.xml:1895
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2855,17 +2811,17 @@ msgstr ""
 "який покаже і адреси PKCS#11."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916 sssd.conf.5.xml:1914
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr "pam_initgroups_scheme"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924 sssd.conf.5.xml:1922
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr "always"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925 sssd.conf.5.xml:1923
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
@@ -2873,12 +2829,12 @@ msgstr ""
 "буде все одно застосовано"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929 sssd.conf.5.xml:1927
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr "no_session"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930 sssd.conf.5.xml:1928
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
@@ -2887,12 +2843,12 @@ msgstr ""
 "тобто якщо користувач не працює у системі"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935 sssd.conf.5.xml:1933
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr "never"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936 sssd.conf.5.xml:1934
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
@@ -2901,7 +2857,7 @@ msgstr ""
 "аж доки вони не застаріють"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919 sssd.conf.5.xml:1917
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2914,18 +2870,17 @@ msgstr ""
 "таких значень: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943 sssd.conf.5.xml:1941
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr "Типове значення: no_session"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377 sssd.conf.5.xml:1946
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr "pam_gssapi_services"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951 sssd.conf.5.xml:1949
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
@@ -2934,7 +2889,7 @@ msgstr ""
 "розпізнавання за GSSAPI за допомогою модуля pam_sss_gss.so."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956 sssd.conf.5.xml:1954
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
@@ -2942,8 +2897,7 @@ msgstr ""
 "значення <quote>-</quote> (дефіс)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
-#: sssd.conf.5.xml:1958 sssd.conf.5.xml:1989 sssd.conf.5.xml:2027
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2955,7 +2909,7 @@ msgstr ""
 "вищий пріоритет за значення у розділі домену."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968 sssd.conf.5.xml:1966
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2965,24 +2919,22 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940 sssd.conf.5.xml:1964
-#: sssd.conf.5.xml:3932
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "Приклад: <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972 sssd.conf.5.xml:1970
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr "Типове значення: - (розпізнавання за GSSAPI вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378 sssd.conf.5.xml:1975
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr "pam_gssapi_check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980 sssd.conf.5.xml:1978
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2994,7 +2946,7 @@ msgstr ""
 "вважатиметься неуспішним, якщо перевірку не буде пройдено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987 sssd.conf.5.xml:1985
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
@@ -3003,12 +2955,12 @@ msgstr ""
 "зможуть отримати бажаний квиток служби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002 sssd.conf.5.xml:2000
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr "pam_gssapi_indicators_map"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005 sssd.conf.5.xml:2003
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -3019,7 +2971,7 @@ msgstr ""
 "відокремлених комами індикаторів розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011 sssd.conf.5.xml:2009
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -3044,7 +2996,7 @@ msgstr ""
 "служби PAM є порожнім, перевірка не закриватиме доступ для жодного запису."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024 sssd.conf.5.xml:2022
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -3055,7 +3007,7 @@ msgstr ""
 "вимкнути перевірку для певної служби PAM, додайте <quote>служба:-</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035 sssd.conf.5.xml:2033
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
@@ -3064,7 +3016,7 @@ msgstr ""
 "індикаторів розпізнавання:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038 sssd.conf.5.xml:2036
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
@@ -3073,7 +3025,7 @@ msgstr ""
 "зберігаються у файлах або на смарткартках."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041 sssd.conf.5.xml:2039
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
@@ -3082,12 +3034,12 @@ msgstr ""
 "розпізнавання у обгортці каналу FAST."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044 sssd.conf.5.xml:2042
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr "radius — попереднє розпізнавання за допомогою сервера RADIUS."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047 sssd.conf.5.xml:2045
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
@@ -3096,14 +3048,14 @@ msgstr ""
 "розпізнавання (2FA або одноразовий пароль, OTP) в IPA."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050 sssd.conf.5.xml:2048
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 "idp — попереднє розпізнавання за допомогою зовнішнього надавача даних "
 "профілів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060 sssd.conf.5.xml:2058
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -3113,7 +3065,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055 sssd.conf.5.xml:2053
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -3125,19 +3077,19 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064 sssd.conf.5.xml:2062
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 "Типове значення: не встановлено (немає потреби у використанні індикаторів "
 "розпізнавання)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2070
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr "Параметри налаштування SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074 sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -3155,12 +3107,12 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091 sssd.conf.5.xml:2089
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr "sudo_timed (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094 sssd.conf.5.xml:2092
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
@@ -3169,12 +3121,12 @@ msgstr ""
 "призначені для визначення часових обмежень для записів sudoers."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106 sssd.conf.5.xml:2104
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr "sudo_threshold (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109 sssd.conf.5.xml:2107
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -3190,22 +3142,22 @@ msgstr ""
 "sudo IPA та групових пошуків команд."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128 sssd.conf.5.xml:2126
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr "Параметри налаштування AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130 sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr "Цими параметрами можна скористатися для налаштування служби autofs."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134 sssd.conf.5.xml:2132
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr "autofs_negative_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137 sssd.conf.5.xml:2135
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -3216,22 +3168,22 @@ msgstr ""
 "базі даних, зокрема неіснуючих) перед повторним запитом до сервера обробки."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153 sssd.conf.5.xml:2151
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr "Параметри налаштувань SSH"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155 sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr "Цими параметрами можна скористатися для налаштування служби SSH."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159 sssd.conf.5.xml:2157
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr "ssh_hash_known_hosts (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162 sssd.conf.5.xml:2160
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
@@ -3239,12 +3191,12 @@ msgstr ""
 "Чи слід хешувати назви та адреси вузлів у керованому файлі known_hosts."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171 sssd.conf.5.xml:2169
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr "ssh_known_hosts_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174 sssd.conf.5.xml:2172
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
@@ -3253,17 +3205,17 @@ msgstr ""
 "файлі known_hosts після надсилання запиту щодо ключів вузла."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178 sssd.conf.5.xml:2176
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr "Типове значення: 180"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183 sssd.conf.5.xml:2181
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr "ssh_use_certificate_keys (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186 sssd.conf.5.xml:2184
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -3277,12 +3229,12 @@ msgstr ""
 "refentrytitle> <manvolnum>1</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201 sssd.conf.5.xml:2199
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr "ssh_use_certificate_matching_rules (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204 sssd.conf.5.xml:2202
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -3298,7 +3250,7 @@ msgstr ""
 "відокремлених комами. Усі інші правила буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213 sssd.conf.5.xml:2211
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -3310,7 +3262,7 @@ msgstr ""
 "сертифікатів."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220 sssd.conf.5.xml:2218
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -3323,7 +3275,7 @@ msgstr ""
 "розпізнавання за сертифікатом."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227 sssd.conf.5.xml:2225
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
@@ -3333,7 +3285,7 @@ msgstr ""
 "проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232 sssd.conf.5.xml:2230
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
@@ -3342,12 +3294,12 @@ msgstr ""
 "використано усі знайдені правила або типове правило"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238 sssd.conf.5.xml:2236
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr "ca_db (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241 sssd.conf.5.xml:2239
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
@@ -3356,12 +3308,12 @@ msgstr ""
 "перевірки сертифікатів користувачів до отримання з них відкритих ключів ssh."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261 sssd.conf.5.xml:2259
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr "Параметри налаштування відповідача PAC"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263 sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -3379,7 +3331,7 @@ msgstr ""
 "декодовано і визначено, виконуються деякі з таких дій:"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272 sssd.conf.5.xml:2270
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -3397,7 +3349,7 @@ msgstr ""
 "параметра default_shell."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280 sssd.conf.5.xml:2278
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
@@ -3406,18 +3358,18 @@ msgstr ""
 "додано до цих груп."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286 sssd.conf.5.xml:2284
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 "Цими параметрами можна скористатися для налаштовування відповідача PAC."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66 sssd.conf.5.xml:2288
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr "allowed_uids (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293 sssd.conf.5.xml:2291
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -3428,7 +3380,7 @@ msgstr ""
 "іменами користувачів визначатимуться під час запуску."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299 sssd.conf.5.xml:2297
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
@@ -3437,14 +3389,14 @@ msgstr ""
 "root і користувачі служб SSSD)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303 sssd.conf.5.xml:2301
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 "Типове значення: 0 (доступ до відповідача PAC має лише адміністративний "
 "користувач (root))"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307 sssd.conf.5.xml:2305
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -3458,7 +3410,7 @@ msgstr ""
 "відповідні записи явно."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314 sssd.conf.5.xml:2312
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -3472,12 +3424,12 @@ msgstr ""
 "запис 0."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323 sssd.conf.5.xml:2321
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr "pac_lifetime (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326 sssd.conf.5.xml:2324
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
@@ -3486,12 +3438,12 @@ msgstr ""
 "використовувати для визначення членства користувача у групі."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336 sssd.conf.5.xml:2334
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr "pac_check (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339 sssd.conf.5.xml:2337
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -3508,12 +3460,12 @@ msgstr ""
 "krb5_validate встановлено значення «False», перевірки PAC буде пропущено."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353 sssd.conf.5.xml:2351
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr "no_check"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355 sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
@@ -3522,12 +3474,12 @@ msgstr ""
 "виконано не буде."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361 sssd.conf.5.xml:2359
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr "pac_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363 sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -3538,12 +3490,12 @@ msgstr ""
 "зазнає невдачі."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371 sssd.conf.5.xml:2369
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr "check_upn"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373 sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
@@ -3552,12 +3504,12 @@ msgstr ""
 "користувача (UPN)."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379 sssd.conf.5.xml:2377
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr "check_upn_allow_missing"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381 sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -3577,7 +3529,7 @@ msgstr ""
 "потреби."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393 sssd.conf.5.xml:2391
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -3594,23 +3546,23 @@ msgstr ""
 "призведе до пропускання перевірки, і повідомлення зникне з журналу."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407 sssd.conf.5.xml:2405
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr "upn_dns_info_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409 sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 "PAC має містити буфер UPN-DNS-INFO; неявним чином встановлює «check_upn»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414 sssd.conf.5.xml:2412
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr "check_upn_dns_info_ex"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416 sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
@@ -3619,12 +3571,12 @@ msgstr ""
 "узгодженими дані у розширенні."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423 sssd.conf.5.xml:2421
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr "upn_dns_info_ex_present"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425 sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
@@ -3633,7 +3585,7 @@ msgstr ""
 "«check_upn_dns_info_ex», «upn_dns_info_present» і «check_upn»."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349 sssd.conf.5.xml:2347
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3642,7 +3594,7 @@ msgstr ""
 "відокремлених комами значень: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435 sssd.conf.5.xml:2433
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
@@ -3651,12 +3603,12 @@ msgstr ""
 "check_upn_allow_missing, check_upn_dns_info_ex»)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444 sssd.conf.5.xml:2442
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr "Параметри налаштовування запису сеансів"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446 sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -3671,32 +3623,32 @@ msgstr ""
 "session-recording</refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459 sssd.conf.5.xml:2457
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr "Цими параметрами можна скористатися для налаштовування запису сеансів."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64 sssd.conf.5.xml:2461
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr "scope (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71 sssd.conf.5.xml:2468
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr "\"none\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74 sssd.conf.5.xml:2471
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr "Користувачі не записуються."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79 sssd.conf.5.xml:2476
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr "\"some\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82 sssd.conf.5.xml:2479
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
@@ -3705,17 +3657,17 @@ msgstr ""
 "<replaceable>користувачі</replaceable> і <replaceable>групи</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91 sssd.conf.5.xml:2488
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr "\"all\""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94 sssd.conf.5.xml:2491
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr "Усі користувачі записуються."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67 sssd.conf.5.xml:2464
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -3724,17 +3676,17 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101 sssd.conf.5.xml:2498
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr "Типове значення: none"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106 sssd.conf.5.xml:2503
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr "users (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109 sssd.conf.5.xml:2506
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -3746,17 +3698,17 @@ msgstr ""
 "тощо."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115 sssd.conf.5.xml:2512
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr "Типове значення: порожнє. Не відповідає жодному користувачу."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120 sssd.conf.5.xml:2517
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr "groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123 sssd.conf.5.xml:2520
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -3768,8 +3720,8 @@ msgstr ""
 "символів тощо."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
-#: sssd-session-recording.5.xml:161 sssd.conf.5.xml:2526 sssd.conf.5.xml:2558
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
+#: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
 "performance cost, because each uncached request for a user requires "
@@ -3781,17 +3733,17 @@ msgstr ""
 "належить користувач."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136 sssd.conf.5.xml:2533
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr "Типове значення: порожнє. Не відповідає жодній групі."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141 sssd.conf.5.xml:2538
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr "exclude_users (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144 sssd.conf.5.xml:2541
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
@@ -3800,17 +3752,17 @@ msgstr ""
 "записування. Може бути застосовано лише разом із «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148 sssd.conf.5.xml:2545
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr "Типове значення: порожнє. Не виключати жодного користувача."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153 sssd.conf.5.xml:2550
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr "exclude_groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156 sssd.conf.5.xml:2553
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
@@ -3819,24 +3771,23 @@ msgstr ""
 "із записування. Може бути застосовано лише разом із «scope=all»."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168 sssd.conf.5.xml:2565
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr "Типове значення: порожнє. Не виключати жодної групи."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577 sssd.conf.5.xml:2575
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr "РОЗДІЛИ ДОМЕНІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072 sssd.conf.5.xml:2582 sssd.conf.5.xml:4060
-#: sssd.conf.5.xml:4061 sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr "enabled"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587 sssd.conf.5.xml:2585
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3851,12 +3802,12 @@ msgstr ""
 "параметрі доменів у розділі <quote>[sssd]</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599 sssd.conf.5.xml:2597
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr "domain_type (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602 sssd.conf.5.xml:2600
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3869,7 +3820,7 @@ msgstr ""
 "з доменів POSIX."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610 sssd.conf.5.xml:2608
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
@@ -3878,7 +3829,7 @@ msgstr ""
 "<quote>application</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614 sssd.conf.5.xml:2612
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3890,7 +3841,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) і відповідача PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622 sssd.conf.5.xml:2620
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
@@ -3899,7 +3850,7 @@ msgstr ""
 "application з <quote>id_provider=ldap</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626 sssd.conf.5.xml:2624
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
@@ -3908,17 +3859,17 @@ msgstr ""
 "ласка, ознайомтеся із розділом <quote>Домени програм</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630 sssd.conf.5.xml:2628
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr "Типове значення: posix"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636 sssd.conf.5.xml:2634
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr "min_id,max_id (ціле значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639 sssd.conf.5.xml:2637
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
@@ -3927,7 +3878,7 @@ msgstr ""
 "відповідає цим обмеженням, його буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644 sssd.conf.5.xml:2642
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3940,7 +3891,7 @@ msgstr ""
 "основної групи і належать діапазону, буде виведено у звичайному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2649
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
@@ -3949,17 +3900,17 @@ msgstr ""
 "лише повернення записів за назвою або ідентифікатором."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655 sssd.conf.5.xml:2653
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr "Типові значення: 1 для min_id, 0 (без обмежень) для max_id"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661 sssd.conf.5.xml:2659
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr "enumerate (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664 sssd.conf.5.xml:2662
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3972,23 +3923,22 @@ msgstr ""
 "мати такі значення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672 sssd.conf.5.xml:2670
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr "TRUE = користувачі і групи нумеруються"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675 sssd.conf.5.xml:2673
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr "FALSE = не використовувати нумерацію для цього домену"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
-#: sssd.conf.5.xml:2676 sssd.conf.5.xml:2961 sssd.conf.5.xml:3138
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr "Типове значення: FALSE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681 sssd.conf.5.xml:2679
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
@@ -3997,7 +3947,7 @@ msgstr ""
 "користувачів і груп із віддаленого сервера."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
@@ -4006,7 +3956,7 @@ msgstr ""
 "id_provider = proxy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690 sssd.conf.5.xml:2688
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -4029,7 +3979,7 @@ msgstr ""
 "<quote>sssd_be</quote> або навіть перезапуску усього засобу стеження."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705 sssd.conf.5.xml:2703
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
@@ -4039,7 +3989,7 @@ msgstr ""
 "завершено."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710 sssd.conf.5.xml:2708
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -4053,7 +4003,7 @@ msgstr ""
 "відповідного використаного засобу обробки ідентифікаторів (id_provider)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718 sssd.conf.5.xml:2716
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
@@ -4062,7 +4012,7 @@ msgstr ""
 "об’ємних середовищах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -4074,32 +4024,32 @@ msgstr ""
 "використано у цій конфігурації."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732 sssd.conf.5.xml:2724
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr "subdomain_enumerate (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739 sssd.conf.5.xml:2731
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr "all"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740 sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr "Усі виявлені надійні домени буде пронумеровано"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743 sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr "none"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744 sssd.conf.5.xml:2736
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr "Нумерація виявлених надійних доменів не виконуватиметься"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735 sssd.conf.5.xml:2727
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -4112,12 +4062,12 @@ msgstr ""
 "доменів, для яких буде увімкнено нумерацію."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758 sssd.conf.5.xml:2750
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr "entry_cache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761 sssd.conf.5.xml:2753
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
@@ -4126,7 +4076,7 @@ msgstr ""
 "надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765 sssd.conf.5.xml:2757
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -4143,17 +4093,17 @@ msgstr ""
 "<manvolnum>8</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778 sssd.conf.5.xml:2770
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr "Типове значення: 5400"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784 sssd.conf.5.xml:2776
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr "entry_cache_user_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787 sssd.conf.5.xml:2779
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
@@ -4162,22 +4112,19 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
-#: sssd.conf.5.xml:2783 sssd.conf.5.xml:2796 sssd.conf.5.xml:2809
-#: sssd.conf.5.xml:2822 sssd.conf.5.xml:2836 sssd.conf.5.xml:2849
-#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2877 sssd.conf.5.xml:2890
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr "Типове значення: entry_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797 sssd.conf.5.xml:2789
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr "entry_cache_group_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800 sssd.conf.5.xml:2792
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
@@ -4186,12 +4133,12 @@ msgstr ""
 "ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810 sssd.conf.5.xml:2802
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr "entry_cache_netgroup_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813 sssd.conf.5.xml:2805
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
@@ -4200,12 +4147,12 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823 sssd.conf.5.xml:2815
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr "entry_cache_service_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826 sssd.conf.5.xml:2818
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
@@ -4214,12 +4161,12 @@ msgstr ""
 "ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836 sssd.conf.5.xml:2828
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr "entry_cache_resolver_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839 sssd.conf.5.xml:2831
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
@@ -4228,12 +4175,12 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850 sssd.conf.5.xml:2842
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr "entry_cache_sudo_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853 sssd.conf.5.xml:2845
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
@@ -4242,12 +4189,12 @@ msgstr ""
 "надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863 sssd.conf.5.xml:2855
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr "entry_cache_autofs_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866 sssd.conf.5.xml:2858
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
@@ -4256,12 +4203,12 @@ msgstr ""
 "чинними, перш ніж надсилати повторний запит до сервера"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877 sssd.conf.5.xml:2869
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr "entry_cache_ssh_host_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880 sssd.conf.5.xml:2872
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
@@ -4271,12 +4218,12 @@ msgstr ""
 "вузла у кеші."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891 sssd.conf.5.xml:2883
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr "entry_cache_computer_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894 sssd.conf.5.xml:2886
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
@@ -4285,12 +4232,12 @@ msgstr ""
 "перш ніж надсилати запит до модуля обробки даних знову"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904 sssd.conf.5.xml:2896
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr "refresh_expired_interval (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907 sssd.conf.5.xml:2899
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
@@ -4300,7 +4247,7 @@ msgstr ""
 "вичерпано або майже вичерпано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912 sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -4314,18 +4261,18 @@ msgstr ""
 "запис користувача, і дані щодо участі у групах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920 sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr "Цей параметр автоматично успадковується для усіх довірених доменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924 sssd.conf.5.xml:2916
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 "Варто визначити для цього параметра значення 3/4 * entry_cache_timeout."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928 sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -4346,18 +4293,18 @@ msgstr ""
 "чинність наявного кешу."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
-#: sssd-ipa.5.xml:270 sssd.conf.5.xml:2933
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
+#: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr "Типове значення: 0 (вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947 sssd.conf.5.xml:2939
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr "cache_credentials (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950 sssd.conf.5.xml:2942
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -4374,7 +4321,7 @@ msgstr ""
 "мережеве розпізнавання було записано до кешу."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961 sssd.conf.5.xml:2953
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -4387,12 +4334,12 @@ msgstr ""
 "додаткових прав доступу) і визначить пароль за допомогою простого перебору."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975 sssd.conf.5.xml:2967
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr "cache_credentials_minimal_first_factor_length (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978 sssd.conf.5.xml:2970
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -4404,7 +4351,7 @@ msgstr ""
 "контрольної суми SHA512 у кеші."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985 sssd.conf.5.xml:2977
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
@@ -4414,12 +4361,12 @@ msgstr ""
 "мішенню атак із перебиранням паролів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996 sssd.conf.5.xml:2988
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr "account_cache_expiration (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999 sssd.conf.5.xml:2991
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -4432,17 +4379,17 @@ msgstr ""
 "offline_credentials_expiration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006 sssd.conf.5.xml:2998
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr "Типове значення: 0 (без обмежень)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011 sssd.conf.5.xml:3003
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr "pwd_expiration_warning (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -4455,17 +4402,17 @@ msgstr ""
 "даних розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029 sssd.conf.5.xml:3021
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr "Типове значення: 7 (Kerberos), 0 (LDAP)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035 sssd.conf.5.xml:3027
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr "id_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038 sssd.conf.5.xml:3030
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
@@ -4473,12 +4420,12 @@ msgstr ""
 "Серед підтримуваних засобів такі:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042 sssd.conf.5.xml:3034
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr "«proxy»: підтримка застарілого модуля надання даних NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045 sssd.conf.5.xml:3037
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4490,7 +4437,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053 sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -4501,9 +4448,8 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286 sssd.conf.5.xml:3053 sssd.conf.5.xml:3164
-#: sssd.conf.5.xml:3215 sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4515,9 +4461,8 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295 sssd.conf.5.xml:3062 sssd.conf.5.xml:3173
-#: sssd.conf.5.xml:3224 sssd.conf.5.xml:3287
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4529,12 +4474,12 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081 sssd.conf.5.xml:3073
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr "use_fully_qualified_names (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084 sssd.conf.5.xml:3076
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
@@ -4544,7 +4489,7 @@ msgstr ""
 "NSS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089 sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -4557,7 +4502,7 @@ msgstr ""
 "не покаже користувача, а <command>getent passwd test@LOCAL</command> покаже."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097 sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -4568,7 +4513,7 @@ msgstr ""
 "груп, якщо задано неповну назву, буде виконано пошук у всіх доменах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104 sssd.conf.5.xml:3096
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
@@ -4577,17 +4522,17 @@ msgstr ""
 "використано default_domain_suffix)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111 sssd.conf.5.xml:3103
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr "ignore_group_members (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3106
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr "Не повертати записи учасників груп для пошуків груп."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117 sssd.conf.5.xml:3109
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -4606,7 +4551,7 @@ msgstr ""
 "$groupname</quote> поверне запитану групу так, наче вона була порожня."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135 sssd.conf.5.xml:3127
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -4617,12 +4562,11 @@ msgstr ""
 "учасників."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086 sssd.conf.5.xml:3133
-#: sssd.conf.5.xml:3854
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
@@ -4631,12 +4575,12 @@ msgstr ""
 "успадковано за допомогою <emphasis>subdomain_inherit</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151 sssd.conf.5.xml:3143
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr "auth_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
@@ -4645,8 +4589,7 @@ msgstr ""
 "служб розпізнавання:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216 sssd.conf.5.xml:3150
-#: sssd.conf.5.xml:3208
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4658,7 +4601,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165 sssd.conf.5.xml:3157
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4670,18 +4613,18 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189 sssd.conf.5.xml:3181
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr "<quote>proxy</quote> — трансльоване розпізнавання у іншій системі PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192 sssd.conf.5.xml:3184
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr "<quote>none</quote> — вимкнути розпізнавання повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195 sssd.conf.5.xml:3187
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
@@ -4690,12 +4633,12 @@ msgstr ""
 "спосіб встановлено і можлива обробка запитів щодо розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201 sssd.conf.5.xml:3193
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr "access_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -4706,7 +4649,7 @@ msgstr ""
 "Вбудованими програмами є:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210 sssd.conf.5.xml:3202
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
@@ -4715,12 +4658,12 @@ msgstr ""
 "доступу для локального домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr "<quote>deny</quote> — завжди забороняти доступ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240 sssd.conf.5.xml:3232
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -4733,7 +4676,7 @@ msgstr ""
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247 sssd.conf.5.xml:3239
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -4745,24 +4688,24 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254 sssd.conf.5.xml:3246
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 "<quote>proxy</quote> — для трансляції керування доступом до іншого модуля "
 "PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257 sssd.conf.5.xml:3249
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr "Типове значення: <quote>permit</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262 sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr "chpass_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265 sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
@@ -4771,7 +4714,7 @@ msgstr ""
 "підтримку таких систем зміни паролів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270 sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4783,7 +4726,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278 sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4795,18 +4738,18 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303 sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr "<quote>proxy</quote> — трансльована зміна пароля у іншій системі PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307 sssd.conf.5.xml:3299
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr "<quote>none</quote> — явно вимкнути можливість зміни пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310 sssd.conf.5.xml:3302
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
@@ -4815,19 +4758,19 @@ msgstr ""
 "цього параметра і якщо система здатна обробляти запити щодо паролів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317 sssd.conf.5.xml:3309
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr "sudo_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320 sssd.conf.5.xml:3312
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 "Служба SUDO, яку використано для цього домену. Серед підтримуваних служб "
 "SUDO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324 sssd.conf.5.xml:3316
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4839,7 +4782,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332 sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
@@ -4848,7 +4791,7 @@ msgstr ""
 "параметрами IPA."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336 sssd.conf.5.xml:3328
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
@@ -4857,22 +4800,20 @@ msgstr ""
 "параметрами AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340 sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr "<quote>none</quote> явним чином вимикає SUDO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555 sssd.conf.5.xml:3335
-#: sssd.conf.5.xml:3421 sssd.conf.5.xml:3486 sssd.conf.5.xml:3511
-#: sssd.conf.5.xml:3547
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 "Типове значення: використовується значення <quote>id_provider</quote>, якщо "
 "його встановлено."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347 sssd.conf.5.xml:3339
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -4891,7 +4832,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362 sssd.conf.5.xml:3354
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -4905,12 +4846,12 @@ msgstr ""
 "sudo у SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372 sssd.conf.5.xml:3364
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr "selinux_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375 sssd.conf.5.xml:3367
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -4921,7 +4862,7 @@ msgstr ""
 "доступу. Передбачено підтримку таких засобів надання даних SELinux:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381 sssd.conf.5.xml:3373
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4933,14 +4874,14 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389 sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 "<quote>none</quote> явним чином забороняє отримання даних щодо параметрів "
 "SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392 sssd.conf.5.xml:3384
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
@@ -4949,12 +4890,12 @@ msgstr ""
 "спосіб встановлено і можлива обробка запитів щодо завантаження SELinux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398 sssd.conf.5.xml:3390
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr "subdomains_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401 sssd.conf.5.xml:3393
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
@@ -4964,7 +4905,7 @@ msgstr ""
 "підтримку таких засобів надання даних піддоменів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407 sssd.conf.5.xml:3399
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4976,7 +4917,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416 sssd.conf.5.xml:3408
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -4989,17 +4930,17 @@ msgstr ""
 "налаштовування засобу надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425 sssd.conf.5.xml:3417
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr "<quote>none</quote> забороняє ячним чином отримання даних піддоменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435 sssd.conf.5.xml:3427
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr "session_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438 sssd.conf.5.xml:3430
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -5011,14 +4952,14 @@ msgstr ""
 "постачальники даних сеансів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445 sssd.conf.5.xml:3437
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 "<quote>ipa</quote>, щоб дозволити пов'язані із сеансами користувачів "
 "завдання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449 sssd.conf.5.xml:3441
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
@@ -5026,7 +4967,7 @@ msgstr ""
 "користувачів завдань."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453 sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
@@ -5035,12 +4976,12 @@ msgstr ""
 "його встановлено і дозволено виконувати пов'язані із сеансами завдання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460 sssd.conf.5.xml:3452
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr "autofs_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463 sssd.conf.5.xml:3455
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
@@ -5048,7 +4989,7 @@ msgstr ""
 "autofs:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467 sssd.conf.5.xml:3459
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5060,7 +5001,7 @@ msgstr ""
 "citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474 sssd.conf.5.xml:3466
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5072,7 +5013,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482 sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -5084,17 +5025,17 @@ msgstr ""
 "надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491 sssd.conf.5.xml:3483
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr "<quote>none</quote> вимикає autofs повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501 sssd.conf.5.xml:3493
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr "hostid_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504 sssd.conf.5.xml:3496
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
@@ -5103,7 +5044,7 @@ msgstr ""
 "вузла. Серед підтримуваних засобів надання hostid:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508 sssd.conf.5.xml:3500
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -5115,17 +5056,17 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516 sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr "<quote>none</quote> вимикає hostid повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526 sssd.conf.5.xml:3518
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr "resolver_provider (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529 sssd.conf.5.xml:3521
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
@@ -5134,7 +5075,7 @@ msgstr ""
 "підтримку таких надавачів даних для визначення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533 sssd.conf.5.xml:3525
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
@@ -5143,7 +5084,7 @@ msgstr ""
 "Див. <quote>proxy_resolver_lib_name</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537 sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -5155,7 +5096,7 @@ msgstr ""
 "manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544 sssd.conf.5.xml:3536
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -5168,13 +5109,13 @@ msgstr ""
 "налаштовування засобу надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 "<quote>none</quote> забороняє ячним чином отримання даних вузлів і мереж."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565 sssd.conf.5.xml:3557
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -5188,7 +5129,7 @@ msgstr ""
 "IPA та доменів Active Directory, простій назві (NetBIOS) домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574 sssd.conf.5.xml:3566
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
@@ -5197,19 +5138,17 @@ msgstr ""
 "name&gt;[^@]+))$</quote>, що дозволяє два різних стилі імен користувачів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593 sssd.conf.5.xml:3571
-#: sssd.conf.5.xml:3585
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr "користувач"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596 sssd.conf.5.xml:3574
-#: sssd.conf.5.xml:3588
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr "користувач@назва.домену"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587 sssd.conf.5.xml:3579
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -5222,12 +5161,12 @@ msgstr ""
 "стилі запису імен користувачів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599 sssd.conf.5.xml:3591
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr "домен\\користувач"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602 sssd.conf.5.xml:3594
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
@@ -5236,7 +5175,7 @@ msgstr ""
 "того, щоб полегшити інтеграцію користувачів з доменів Windows."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607 sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -5251,17 +5190,17 @@ msgstr ""
 "ім'я з <quote>@</quote>, йому слід скорити власний re_expression."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659 sssd.conf.5.xml:3651
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr "Типове значення: <quote>%1$s@%2$s</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665 sssd.conf.5.xml:3657
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr "lookup_family_order (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668 sssd.conf.5.xml:3660
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
@@ -5270,48 +5209,48 @@ msgstr ""
 "під час виконання пошуків у DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672 sssd.conf.5.xml:3664
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr "Передбачено підтримку таких значень:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675 sssd.conf.5.xml:3667
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 "ipv4_first: спробувати визначити адресу у форматі IPv4, у разі невдачі "
 "спробувати формат IPv6"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3670
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 "ipv4_only: намагатися визначити назви вузлів лише у форматі адрес IPv4."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681 sssd.conf.5.xml:3673
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 "ipv6_first: спробувати визначити адресу у форматі IPv6, у разі невдачі "
 "спробувати формат IPv4"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684 sssd.conf.5.xml:3676
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 "ipv6_only: намагатися визначити назви вузлів лише у форматі адрес IPv6."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687 sssd.conf.5.xml:3679
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr "Типове значення: ipv4_first"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693 sssd.conf.5.xml:3685
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr "dns_resolver_server_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696 sssd.conf.5.xml:3688
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
@@ -5320,7 +5259,7 @@ msgstr ""
 "обмінятися даними із сервером DNS, перш ніж пробувати наступний сервер DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701 sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
@@ -5328,8 +5267,7 @@ msgstr ""
 "очікування на відгук на луна-імпульс CLDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
-#: sssd.conf.5.xml:3697 sssd.conf.5.xml:3717 sssd.conf.5.xml:3738
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
@@ -5338,18 +5276,17 @@ msgstr ""
 "більше про розв'язування питань, пов'язаних із службами."
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
-#: sssd.conf.5.xml:3702
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr "Типове значення: 1000"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716 sssd.conf.5.xml:3708
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr "dns_resolver_op_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719 sssd.conf.5.xml:3711
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
@@ -5360,13 +5297,18 @@ msgstr ""
 "вузла або запису SRV), перш ніж перейти до наступної назви вузла або пошуку "
 "наступного DNS."
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "Типове значення: 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736 sssd.conf.5.xml:3728
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr "dns_resolver_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739 sssd.conf.5.xml:3731
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -5379,12 +5321,12 @@ msgstr ""
 "роботу у автономному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757 sssd.conf.5.xml:3749
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr "dns_resolver_use_search_list (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760 sssd.conf.5.xml:3752
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -5395,7 +5337,7 @@ msgstr ""
 "затримок у середовищах, де DNS не налаштовано належним чином."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766 sssd.conf.5.xml:3758
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -5406,17 +5348,17 @@ msgstr ""
 "пошукам DNS у таких середовищах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772 sssd.conf.5.xml:3764
+#: sssd.conf.5.xml:3745
 msgid "Default: TRUE"
 msgstr "Типове значення: TRUE"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778 sssd.conf.5.xml:3770
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr "dns_discovery_domain (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781 sssd.conf.5.xml:3773
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
@@ -5425,18 +5367,18 @@ msgstr ""
 "частину запиту визначення служб DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785 sssd.conf.5.xml:3777
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 "Типова поведінка: використовувати назву домену з назви вузла комп’ютера."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791 sssd.conf.5.xml:3783
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr "failover_primary_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794 sssd.conf.5.xml:3786
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -5447,58 +5389,58 @@ msgstr ""
 "встановити з'єднання із основним сервером."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801 sssd.conf.5.xml:3793
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr "Зауваження: мінімальним значенням є 31."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804 sssd.conf.5.xml:3796
+#: sssd.conf.5.xml:3777
 msgid "Default: 31"
 msgstr "Типове значення: 31"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810 sssd.conf.5.xml:3802
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr "override_gid (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813 sssd.conf.5.xml:3805
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr "Замірити значення основного GID на вказане."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819 sssd.conf.5.xml:3811
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr "case_sensitive (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826 sssd.conf.5.xml:3818
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr "True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829 sssd.conf.5.xml:3821
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 "Враховується регістр. Це значення є некоректним для засобу надання даних AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835 sssd.conf.5.xml:3827
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr "False"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837 sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr "Без врахування регістру."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841 sssd.conf.5.xml:3833
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr "Preserving"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844 sssd.conf.5.xml:3836
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -5510,7 +5452,7 @@ msgstr ""
 "буде переведено у нижній регістр."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852 sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
@@ -5519,7 +5461,7 @@ msgstr ""
 "даних IPA, вам доведеться встановити його на боці клієнта і SSSD на сервері."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822 sssd.conf.5.xml:3814
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -5528,17 +5470,17 @@ msgstr ""
 "значення: <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867 sssd.conf.5.xml:3859
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr "Типове значення: True (False для засобу надання даних AD)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873 sssd.conf.5.xml:3865
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr "subdomain_inherit (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876 sssd.conf.5.xml:3868
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -5550,47 +5492,47 @@ msgstr ""
 "параметрів:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882 sssd.conf.5.xml:3874
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr "ldap_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885 sssd.conf.5.xml:3877
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr "ldap_network_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888 sssd.conf.5.xml:3880
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr "ldap_opt_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891 sssd.conf.5.xml:3883
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr "ldap_offline_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894 sssd.conf.5.xml:3886
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr "ldap_enumeration_refresh_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897 sssd.conf.5.xml:3889
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr "ldap_enumeration_refresh_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900 sssd.conf.5.xml:3892
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr "ldap_purge_cache_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903 sssd.conf.5.xml:3895
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr "ldap_purge_cache_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906 sssd.conf.5.xml:3898
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
@@ -5599,57 +5541,57 @@ msgstr ""
 "ldap_krb5_keytab не встановлено явним чином)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910 sssd.conf.5.xml:3902
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr "ldap_krb5_ticket_lifetime"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913 sssd.conf.5.xml:3905
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr "ldap_enumeration_search_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916 sssd.conf.5.xml:3908
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr "ldap_connection_expire_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919 sssd.conf.5.xml:3911
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr "ldap_connection_expire_offset"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922 sssd.conf.5.xml:3914
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr "ldap_connection_idle_timeout"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401 sssd.conf.5.xml:3917
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr "ldap_use_tokengroups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928 sssd.conf.5.xml:3920
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr "ldap_user_principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931 sssd.conf.5.xml:3923
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr "ignore_group_members"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934 sssd.conf.5.xml:3926
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr "auto_private_groups"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937 sssd.conf.5.xml:3929
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr "case_sensitive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942 sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -5659,28 +5601,28 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949 sssd.conf.5.xml:3941
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 "Зауваження: цей параметр працює лише для засобів надання даних IPA і AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956 sssd.conf.5.xml:3948
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr "subdomain_homedir (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967 sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr "%F"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968 sssd.conf.5.xml:3960
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr "спрощена (NetBIOS) назва піддомену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959 sssd.conf.5.xml:3951
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -5695,7 +5637,7 @@ msgstr ""
 "emphasis>.  <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973 sssd.conf.5.xml:3965
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
@@ -5703,17 +5645,17 @@ msgstr ""
 "emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977 sssd.conf.5.xml:3969
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr "Типове значення: <filename>/home/%d/%u</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982 sssd.conf.5.xml:3974
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr "realmd_tags (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985 sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
@@ -5721,12 +5663,12 @@ msgstr ""
 "домену."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991 sssd.conf.5.xml:3983
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr "cached_auth_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994 sssd.conf.5.xml:3986
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -5740,7 +5682,7 @@ msgstr ""
 "розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002 sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
@@ -5750,12 +5692,12 @@ msgstr ""
 "значення для різних довірених доменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007 sssd.conf.5.xml:3999
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr "Спеціальне значення 0 означає, що цю можливість вимкнено."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011 sssd.conf.5.xml:4003
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -5766,12 +5708,12 @@ msgstr ""
 "обробки <quote>initgroups</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022 sssd.conf.5.xml:4014
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr "local_auth_policy (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025 sssd.conf.5.xml:4017
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -5791,7 +5733,7 @@ msgstr ""
 "методи, обробка і перевірка у яких відбуватиметься локально."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037 sssd.conf.5.xml:4029
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -5811,7 +5753,7 @@ msgstr ""
 "<quote>enable:passkey, enable:smartcard</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -5822,43 +5764,42 @@ msgstr ""
 "при типовому значенні local_auth_policy: <quote>match</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4055
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr "local_auth_policy = match (типове значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064 sssd.conf.5.xml:4056
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr "Ключ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065 sssd.conf.5.xml:4057
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr "Картка пам'яті"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189 sssd.conf.5.xml:4060
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr "IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194 sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr "AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
-#: sssd.conf.5.xml:4063 sssd.conf.5.xml:4066 sssd.conf.5.xml:4067
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr "вимкнено"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074 sssd.conf.5.xml:4066
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr "LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079 sssd.conf.5.xml:4071
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -5872,7 +5813,7 @@ msgstr ""
 "наприклад, запиту щодо пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091 sssd.conf.5.xml:4083
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -5888,7 +5829,7 @@ msgstr ""
 "local_auth_policy = only\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087 sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -5899,7 +5840,7 @@ msgstr ""
 "smartcard, passkey).  <placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099 sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
@@ -5908,22 +5849,22 @@ msgstr ""
 "local_auth_policy і підтримує типово розпізнавання за карткою пам'яті."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104 sssd.conf.5.xml:4096
+#: sssd.conf.5.xml:4077
 msgid "Default: match"
 msgstr "Типове значення: match"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109 sssd.conf.5.xml:4101
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr "auto_private_groups (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115 sssd.conf.5.xml:4107
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr "true"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118 sssd.conf.5.xml:4110
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
@@ -5932,7 +5873,7 @@ msgstr ""
 "користувача. У цьому випадку номер GID буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122 sssd.conf.5.xml:4114
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -5945,12 +5886,12 @@ msgstr ""
 "примусово встановлює унікальність записів у просторі ідентифікаторів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131 sssd.conf.5.xml:4123
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr "false"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134 sssd.conf.5.xml:4126
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
@@ -5959,12 +5900,12 @@ msgstr ""
 "вказувати на об'єкт групи у базі даних LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140 sssd.conf.5.xml:4132
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr "hybrid"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143 sssd.conf.5.xml:4135
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -5979,7 +5920,7 @@ msgstr ""
 "цього користувача визначатиме цей об'єкт групи."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156 sssd.conf.5.xml:4148
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
@@ -5988,7 +5929,7 @@ msgstr ""
 "групи, інакше надійне визначення GID буде просто неможливим."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163 sssd.conf.5.xml:4155
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -5999,7 +5940,7 @@ msgstr ""
 "збереженням наявних приватних груп для користувачів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112 sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6008,7 +5949,7 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175 sssd.conf.5.xml:4167
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
@@ -6018,7 +5959,7 @@ msgstr ""
 "використовується автоматична прив'язка до ідентифікаторів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183 sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -6028,7 +5969,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189 sssd.conf.5.xml:4181
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -6040,7 +5981,7 @@ msgstr ""
 "auto_private_groups = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180 sssd.conf.5.xml:4172
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -6054,7 +5995,7 @@ msgstr ""
 "subdomain_inherit: <placeholder type=\"programlisting\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579 sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -6065,17 +6006,17 @@ msgstr ""
 "quote> <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204 sssd.conf.5.xml:4196
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr "proxy_pam_target (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207 sssd.conf.5.xml:4199
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr "Комп’ютер, для якого виконує проксі-сервер PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210 sssd.conf.5.xml:4202
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -6087,12 +6028,12 @@ msgstr ""
 "local_auth_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220 sssd.conf.5.xml:4212
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr "proxy_lib_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223 sssd.conf.5.xml:4215
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -6103,12 +6044,12 @@ msgstr ""
 "наприклад _nss_files_getpwent."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233 sssd.conf.5.xml:4225
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr "proxy_resolver_lib_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236 sssd.conf.5.xml:4228
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -6119,12 +6060,12 @@ msgstr ""
 "_nss_$(назва_бібліотеки)_$(функція), наприклад _nss_dns_gethostbyname2_r."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247 sssd.conf.5.xml:4239
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr "proxy_fast_alias (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250 sssd.conf.5.xml:4242
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -6139,12 +6080,12 @@ msgstr ""
 "у кеші, щоб пришвидшити надання результатів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264 sssd.conf.5.xml:4256
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr "proxy_max_children (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267 sssd.conf.5.xml:4259
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -6156,7 +6097,7 @@ msgstr ""
 "використання черги запитів."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200 sssd.conf.5.xml:4192
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
@@ -6165,12 +6106,12 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283 sssd.conf.5.xml:4275
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr "Домени програм (application)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285 sssd.conf.5.xml:4277
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -6198,7 +6139,7 @@ msgstr ""
 "який може успадковувати параметр з традиційного домену SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305 sssd.conf.5.xml:4297
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -6209,17 +6150,17 @@ msgstr ""
 "його доменом-близнюком у POSIX має бути встановлено належним чином."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311 sssd.conf.5.xml:4303
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr "Параметри доменів програм"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313 sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr "inherit_from (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316 sssd.conf.5.xml:4308
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -6231,7 +6172,7 @@ msgstr ""
 "розширюють або перевизначають параметри домену-<quote>близнюка</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330 sssd.conf.5.xml:4322
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -6246,7 +6187,7 @@ msgstr ""
 "у кеші і робить атрибут phone доступним через інтерфейс D-Bus."
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338 sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6280,12 +6221,12 @@ msgstr ""
 "ldap_user_extra_attrs = phone:telephoneNumber\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358 sssd.conf.5.xml:4350
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr "РОЗДІЛ ДОВІРЕНИХ ДОМЕНІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360 sssd.conf.5.xml:4352
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -6303,57 +6244,57 @@ msgstr ""
 "такі параметри:"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367 sssd.conf.5.xml:4359
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr "ldap_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368 sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr "ldap_user_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369 sssd.conf.5.xml:4361
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr "ldap_group_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370 sssd.conf.5.xml:4362
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr "ldap_netgroup_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371 sssd.conf.5.xml:4363
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr "ldap_service_search_base,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372 sssd.conf.5.xml:4364
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr "ldap_sasl_mech,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373 sssd.conf.5.xml:4365
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr "ad_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374 sssd.conf.5.xml:4366
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr "ad_backup_server,"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375 sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr "ad_site,"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884 sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr "use_fully_qualified_names"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380 sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
@@ -6362,12 +6303,12 @@ msgstr ""
 "підручника."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr "РОЗДІЛ ПРИВ'ЯЗКИ СЕРТИФІКАТІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388 sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -6390,7 +6331,7 @@ msgstr ""
 "використовують для розпізнавання PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402 sssd.conf.5.xml:4394
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -6402,7 +6343,7 @@ msgstr ""
 "citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411 sssd.conf.5.xml:4403
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -6415,12 +6356,12 @@ msgstr ""
 "replaceable>]</quote>. У цьому розділі можна використовувати такі параметри:"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418 sssd.conf.5.xml:4410
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr "matchrule (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421 sssd.conf.5.xml:4413
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
@@ -6429,7 +6370,7 @@ msgstr ""
 "цьому правилу. Усі інші сертифікати буде проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425 sssd.conf.5.xml:4417
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
@@ -6439,17 +6380,17 @@ msgstr ""
 "<quote>clientAuth</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432 sssd.conf.5.xml:4424
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr "maprule (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435 sssd.conf.5.xml:4427
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr "Визначає спосіб пошуку користувача для вказаного сертифіката."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441 sssd.conf.5.xml:4433
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
@@ -6458,7 +6399,7 @@ msgstr ""
 "даних, зокрема <quote>ldap</quote>, <quote>AD</quote> та <quote>ipa</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447 sssd.conf.5.xml:4439
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
@@ -6467,12 +6408,12 @@ msgstr ""
 "запис користувача і такою самою назвою."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456 sssd.conf.5.xml:4448
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr "domains (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459 sssd.conf.5.xml:4451
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -6485,17 +6426,17 @@ msgstr ""
 "параметр можна використати і для додавання правила до піддоменів."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466 sssd.conf.5.xml:4458
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr "Типове значення: домен, який налаштовано у sssd.conf"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471 sssd.conf.5.xml:4463
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr "priority (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474 sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -6506,12 +6447,12 @@ msgstr ""
 "пріоритетність, а <quote>4294967295</quote> — найнижча."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480 sssd.conf.5.xml:4472
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr "Типове значення: найнижча пріоритетність"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486 sssd.conf.5.xml:4478
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
@@ -6521,7 +6462,7 @@ msgstr ""
 "спеціальних властивостей:"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492 sssd.conf.5.xml:4484
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
@@ -6530,7 +6471,7 @@ msgstr ""
 "відповідного облікового запису користувача"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498 sssd.conf.5.xml:4490
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -6543,17 +6484,17 @@ msgstr ""
 "quote> або <quote>({назва_об'єкта_rfc822.коротка_назва})</quote>"
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507 sssd.conf.5.xml:4499
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr "параметр <quote>domains</quote> буде проігноровано"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515 sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr "РОЗДІЛ НАЛАШТОВУВАННЯ ЗАПИТІВ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517 sssd.conf.5.xml:4509
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -6569,7 +6510,7 @@ msgstr ""
 "реєстраційних даних."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525 sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -6583,22 +6524,22 @@ msgstr ""
 "випадках мають забезпечити описані нижче параметри."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537 sssd.conf.5.xml:4529
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr "[prompting/password]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540 sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr "password_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541 sssd.conf.5.xml:4533
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr "для зміни рядка запиту пароля"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539 sssd.conf.5.xml:4531
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
@@ -6607,37 +6548,37 @@ msgstr ""
 "type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549 sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr "[prompting/2fa]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553 sssd.conf.5.xml:4545
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr "first_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554 sssd.conf.5.xml:4546
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr "для зміни рядка запиту для першого фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557 sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr "second_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558 sssd.conf.5.xml:4550
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr "для зміни рядка запиту для другого фактора"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561 sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr "single_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562 sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -6650,7 +6591,7 @@ msgstr ""
 "якщо другий фактор не є обов'язковим."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551 sssd.conf.5.xml:4543
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -6662,18 +6603,29 @@ msgstr ""
 "фактор є необов'язковим і має бути збережено можливість входу або лише за "
 "паролем, або за двома факторами, має бути використано двокроковий запит."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579 sssd.conf.5.xml:4571
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr "[prompting/passkey]"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021 sssd.conf.5.xml:4577
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr "interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587 sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -6684,22 +6636,22 @@ msgstr ""
 "тактильного перемикача."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595 sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr "interactive_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597 sssd.conf.5.xml:4589
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr "для зміни повідомлення інтерактивного запиту."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602 sssd.conf.5.xml:4594
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr "touch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604 sssd.conf.5.xml:4596
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
@@ -6708,17 +6660,17 @@ msgstr ""
 "користувачеві щодо потреби торкнутися пристрою."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610 sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr "touch_prompt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612 sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr "для зміни повідомлення запиту щодо торкання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581 sssd.conf.5.xml:4573
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
@@ -6727,7 +6679,7 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532 sssd.conf.5.xml:4524
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -6740,7 +6692,7 @@ msgstr ""
 "type=\"variablelist\" id=\"1\"/><placeholder type=\"variablelist\" id=\"2\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623 sssd.conf.5.xml:4615
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -6751,13 +6703,12 @@ msgstr ""
 "для цієї служби."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
-#: sssd.conf.5.xml:4622
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr "ПРИКЛАДИ"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636 sssd.conf.5.xml:4628
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -6809,7 +6760,7 @@ msgstr ""
 "enumerate = False\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632 sssd.conf.5.xml:4624
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -6822,7 +6773,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668 sssd.conf.5.xml:4660
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -6832,7 +6783,7 @@ msgstr ""
 "use_fully_qualified_names = false\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662 sssd.conf.5.xml:4654
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -6849,7 +6800,7 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679 sssd.conf.5.xml:4671
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -6865,7 +6816,7 @@ msgstr ""
 "priority = 10\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673 sssd.conf.5.xml:4665
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -7068,7 +7019,7 @@ msgstr ""
 "специфікації http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr "Приклади:"
@@ -7586,7 +7537,7 @@ msgstr ""
 "параметром <emphasis>ldap_connection_expire_offset</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr "Типове значення: 900 (15 хвилин)"
 
@@ -7913,7 +7864,7 @@ msgstr ""
 "розпізнаються <command>sssd</command>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -7928,11 +7879,19 @@ msgstr "ldap_tls_cacertdir (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ldap.5.xml:855
+#, fuzzy
+#| msgid ""
+#| "Specifies the path of a directory that contains Certificate Authority "
+#| "certificates in separate individual files. Typically the file names need "
+#| "to be the hash of the certificate followed by '.0'.  If available, "
+#| "<command>cacertdir_rehash</command> can be used to create the correct "
+#| "names."
 msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 "Визначає шлях до каталогу, де у окремих файлах містяться сертифікати служб "
 "сертифікації (CA). Типовими назвами файлів є хеші сертифікатів з додаванням "
@@ -7940,32 +7899,32 @@ msgstr ""
 "<command>cacertdir_rehash</command>, якщо ця програма є доступною."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr "ldap_tls_cert (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr "Визначає файл, який містить сертифікат для ключа клієнта."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr "ldap_tls_key (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr "Визначає файл, у якому міститься ключ клієнта."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr "ldap_tls_cipher_suite (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -7977,12 +7936,12 @@ msgstr ""
 "<manvolnum>5</manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr "ldap_id_use_start_tls (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -7993,12 +7952,12 @@ msgstr ""
 "наполегливо рекомендуємо значення <emphasis>true</emphasis> ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr "ldap_id_mapping (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -8010,19 +7969,19 @@ msgstr ""
 "ldap_group_gid_number."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 "У поточній версії у цій можливості передбачено підтримку лише встановлення "
 "відповідності objectSID у ActiveDirectory."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr "ldap_min_id, ldap_max_id (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -8042,18 +8001,18 @@ msgstr ""
 "ідентифікаторів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 "Типове значення: не встановлено (обидва параметри встановлено у значення 0)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr "ldap_sasl_mech (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
@@ -8062,7 +8021,7 @@ msgstr ""
 "перевірено і передбачено підтримку лише механізмів GSSAPI та GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -8080,12 +8039,12 @@ msgstr ""
 "manvolnum></citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr "ldap_sasl_authid (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -8105,7 +8064,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -8126,17 +8085,17 @@ msgstr ""
 "таблиці ключів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr "Типове значення: вузол/назва_вузла@ОБЛАСТЬ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr "ldap_sasl_realm (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -8148,17 +8107,17 @@ msgstr ""
 "проігноровано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr "Типове значення: значення krb5_realm."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr "ldap_sasl_canonicalize (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
@@ -8168,36 +8127,36 @@ msgstr ""
 "SASL."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr "Типове значення: false;"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr "ldap_krb5_keytab (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 "Визначає таблицю ключів, яку слід використовувати разом з SASL/GSSAPI/GSS-"
 "SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 "Типове значення: системна таблиця ключів, зазвичай <filename>/etc/krb5."
 "keytab</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr "ldap_krb5_init_creds (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -8208,12 +8167,12 @@ msgstr ""
 "механізм GSSAPI або GSS-SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr "ldap_krb5_ticket_lifetime (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
@@ -8221,17 +8180,17 @@ msgstr ""
 "SPNEGO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr "Типове значення: 86400 (24 години)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr "krb5_server, krb5_backup_server (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -8250,7 +8209,7 @@ msgstr ""
 "про виявлення служб можна дізнатися з розділу «ПОШУК СЛУЖБ»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -8262,7 +8221,7 @@ msgstr ""
 "вдасться знайти."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -8273,30 +8232,30 @@ msgstr ""
 "варто перейти на використання «krb5_server» у файлах налаштувань."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr "krb5_realm (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 "Вказати область Kerberos (для розпізнавання за SASL/GSSAPI/GSS-SPNEGO)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 "Типове значення: типове значення системи, див. <filename>/etc/krb5.conf</"
 "filename>"
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
@@ -8306,12 +8265,12 @@ msgstr ""
 "версії MIT Kerberos >= 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -8326,7 +8285,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -8337,12 +8296,12 @@ msgstr ""
 "manvolnum> </citerefentry>, щоб дізнатися більше про додаток пошуку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr "ldap_pwd_policy (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
@@ -8351,7 +8310,7 @@ msgstr ""
 "використовувати такі значення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
@@ -8360,7 +8319,7 @@ msgstr ""
 "разі використання цього варіанта перевірку на боці сервера вимкнено не буде."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -8372,7 +8331,7 @@ msgstr ""
 "manvolnum></citerefentry> для визначення того, чи чинним є пароль."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -8383,7 +8342,7 @@ msgstr ""
 "скористайтеся chpass_provider=krb5 для оновлення цих атрибутів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
@@ -8393,18 +8352,18 @@ msgstr ""
 "встановленими за допомогою цього параметра."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr "ldap_referrals (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 "Визначає, чи має бути увімкнено автоматичне визначення напрямків пошуку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
@@ -8413,7 +8372,7 @@ msgstr ""
 "з версією OpenLDAP 2.4.13 або новішою версією."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -8435,28 +8394,28 @@ msgstr ""
 "дані виявляться недоступними."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr "ldap_dns_service_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 "Визначає назву служби, яку буде використано у разі вмикання визначення служб."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr "Типове значення: ldap"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr "ldap_chpass_dns_service_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
@@ -8465,17 +8424,17 @@ msgstr ""
 "уможливлює зміну паролів, у разі вмикання визначення служб."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr "Типове значення: не встановлено, тобто пошук служб вимкнено"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr "ldap_chpass_update_last_change (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
@@ -8484,7 +8443,7 @@ msgstr ""
 "щодо кількості днів з часу виконання дії зі зміни пароля."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -8497,12 +8456,12 @@ msgstr ""
 "окремо."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr "ldap_access_filter (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -8531,12 +8490,12 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr "Приклад:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -8548,7 +8507,7 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
@@ -8557,7 +8516,7 @@ msgstr ""
 "employeeType встановлено у значення «admin»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -8571,17 +8530,17 @@ msgstr ""
 "таких прав не було надано, у автономному режимі їх також не буде надано."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr "Типове значення: порожній рядок"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr "ldap_account_expire_policy (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
@@ -8590,7 +8549,7 @@ msgstr ""
 "керування доступом на боці клієнта."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -8601,12 +8560,12 @@ msgstr ""
 "з відповідним кодом помилки, навіть якщо вказано правильний пароль."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr "Можна використовувати такі значення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
@@ -8615,7 +8574,7 @@ msgstr ""
 "визначити, чи завершено строк дії облікового запису."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -8628,7 +8587,7 @@ msgstr ""
 "Також буде перевірено, чи не вичерпано строк дії облікового запису."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -8639,7 +8598,7 @@ msgstr ""
 "ldap_ns_account_lock."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -8652,7 +8611,7 @@ msgstr ""
 "атрибутів, надати доступ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -8663,24 +8622,24 @@ msgstr ""
 "користуватися параметром ldap_account_expire_policy."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr "ldap_access_order (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 "Список відокремлених комами параметрів керування доступом. Можливі значення "
 "списку:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr "<emphasis>filter</emphasis>: використовувати ldap_access_filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8695,7 +8654,7 @@ msgstr ""
 "для працездатності цієї можливості слід встановити «access_provider = ldap»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
@@ -8705,7 +8664,7 @@ msgstr ""
 "emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -8728,13 +8687,13 @@ msgstr ""
 "параметра слід встановити значення «access_provider = ldap»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 "<emphasis>expire</emphasis>: використовувати ldap_account_expire_policy"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -8749,7 +8708,7 @@ msgstr ""
 "наприклад на ключах SSH."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
@@ -8758,17 +8717,17 @@ msgstr ""
 "дії пароля буде вичерпано:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr "pwd_expire_policy_reject — користувачу заборонено входити,"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr "pwd_expire_policy_warn — користувачу можна входити,"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
@@ -8777,17 +8736,23 @@ msgstr ""
 "пароль."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
+#, fuzzy
+#| msgid ""
+#| "Please note that 'access_provider = ldap' must be set for this feature to "
+#| "work. Also 'ldap_pwd_policy' must be set to an appropriate password "
+#| "policy."
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 "Будь ласка, зауважте, що для того, щоб цим можна було скористатися, слід "
 "встановити «access_provider = ldap». Крім того, слід встановити для "
 "параметра «ldap_pwd_policy» відповідні правила поводження із паролями."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
@@ -8796,14 +8761,14 @@ msgstr ""
 "можливості доступу атрибут authorizedService"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 "<emphasis>host</emphasis>: за допомогою цього атрибута вузла можна визначити "
 "права доступу"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
@@ -8812,7 +8777,7 @@ msgstr ""
 "того, чи матиме віддалений вузол доступ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
@@ -8822,12 +8787,12 @@ msgstr ""
 "керування доступом."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr "Типове значення: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
@@ -8836,12 +8801,12 @@ msgstr ""
 "використано декілька разів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr "ldap_pwdlockout_dn (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -8855,22 +8820,22 @@ msgstr ""
 "можна буде перевірити належним чином."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr "Приклад: cn=ppolicy,ou=policies,dc=example,dc=com"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr "Типове значення: cn=ppolicy,ou=policies,$ldap_search_base"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr "ldap_deref (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
@@ -8879,13 +8844,13 @@ msgstr ""
 "пошуку. Можливі такі варіанти:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 "<emphasis>never</emphasis>: ніколи не виконувати розіменування псевдонімів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
@@ -8895,7 +8860,7 @@ msgstr ""
 "пошуку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
@@ -8904,7 +8869,7 @@ msgstr ""
 "під час визначення місця основного об’єкта пошуку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
@@ -8913,7 +8878,7 @@ msgstr ""
 "час пошуку, так і під час визначення місця основного об’єкта пошуку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
@@ -8922,12 +8887,12 @@ msgstr ""
 "сценарієм <emphasis>never</emphasis>)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr "ldap_rfc2307_fallback_to_local_users (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
@@ -8936,7 +8901,7 @@ msgstr ""
 "серверів, у яких використовується схема RFC2307."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -8954,7 +8919,7 @@ msgstr ""
 "користувачів за допомогою виклику getpw*() або initgroups()."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -8966,12 +8931,12 @@ msgstr ""
 "групами LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr "wildcard_limit (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
@@ -8980,24 +8945,24 @@ msgstr ""
 "пошуку з використанням символів-замінників."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 "У поточній версії пошук із використанням символів-замінників передбачено "
 "лише для відповідача InfoPipe."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr "Типове значення: 1000 (часто розмір однієї сторінки)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr "ldap_library_debug_level (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
@@ -9006,7 +8971,7 @@ msgstr ""
 "libldap буде записано незалежно від загального debug_level."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
@@ -9015,17 +8980,17 @@ msgstr ""
 "компонентів, -1 увімкне повне виведення діагностичних даних."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr "Типове значення: 0 (діагностику libldap вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr "ldap_use_ppolicy (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
@@ -9035,6 +9000,24 @@ msgstr ""
 "сервера. Вимикання цього параметра дозволяє взаємодію із службами, які "
 "надсилають у відповідні некоректне розширення правил."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+#, fuzzy
+#| msgid "ldap_deref_threshold (integer)"
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr "ldap_deref_threshold (ціле число)"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -9056,12 +9039,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr "ПАРАМЕТРИ SUDO"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -9072,12 +9055,12 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr "ldap_sudo_full_refresh_interval (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
@@ -9087,7 +9070,7 @@ msgstr ""
 "набір правил, що зберігаються на сервері."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
@@ -9096,7 +9079,7 @@ msgstr ""
 "<emphasis>ldap_sudo_smart_refresh_interval </emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
@@ -9106,17 +9089,17 @@ msgstr ""
 "оновлення."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr "Типове значення: 21600 (6 годин)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr "ldap_sudo_smart_refresh_interval (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -9127,7 +9110,7 @@ msgstr ""
 "правил, USN яких перевищує найбільше значення сервера USN, яке відоме SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
@@ -9136,7 +9119,7 @@ msgstr ""
 "дані атрибута modifyTimestamp."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -9152,7 +9135,7 @@ msgstr ""
 "emphasis>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
@@ -9162,12 +9145,12 @@ msgstr ""
 "оновлення."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr "ldap_sudo_random_offset (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -9178,7 +9161,7 @@ msgstr ""
 "регулярного завдання. Значення у секундах."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -9189,17 +9172,17 @@ msgstr ""
 "час, протягом якого правила sudo є недоступними для використання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr "Ви можете вимкнути цей зсув, встановивши значення 0."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr "ldap_sudo_use_host_filter (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
@@ -9209,12 +9192,12 @@ msgstr ""
 "назв вузлів)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr "ldap_sudo_hostnames (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
@@ -9223,7 +9206,7 @@ msgstr ""
 "фільтрування списку правил."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
@@ -9232,8 +9215,8 @@ msgstr ""
 "назву вузла та повну назву комп’ютера у домені у автоматичному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
@@ -9242,17 +9225,17 @@ msgstr ""
 "<emphasis>false</emphasis>, цей параметр ні на що не впливатиме."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr "Типове значення: не вказано"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr "ldap_sudo_ip (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
@@ -9261,7 +9244,7 @@ msgstr ""
 "правил."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
@@ -9270,12 +9253,12 @@ msgstr ""
 "адресу у автоматичному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr "ldap_sudo_include_netgroups (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
@@ -9284,12 +9267,12 @@ msgstr ""
 "мережеву групу (netgroup) у атрибуті sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr "ldap_sudo_include_regexp (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
@@ -9298,7 +9281,7 @@ msgstr ""
 "заміни у атрибуті sudoHost."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
@@ -9307,7 +9290,7 @@ msgstr ""
 "для сервера LDAP!"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -9320,12 +9303,12 @@ msgstr ""
 "refentrytitle><manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr "ПАРАМЕТРИ AUTOFS"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
@@ -9334,47 +9317,47 @@ msgstr ""
 "LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr "ldap_autofs_map_master_name (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr "Назва основної карти автоматичного монтування у LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr "Типове значення: auto.master"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr "ДОДАТКОВІ ПАРАМЕТРИ"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr "ldap_netgroup_search_base (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr "ldap_user_search_base (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr "ldap_group_search_base (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr "<note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -9387,22 +9370,22 @@ msgstr ""
 "груп показуються неправильно."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr "</note>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr "ldap_sudo_search_base (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr "ldap_autofs_search_base (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -9415,14 +9398,14 @@ msgstr ""
 "<placeholder type=\"variablelist\" id=\"1\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr "ПРИКЛАД"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -9433,7 +9416,7 @@ msgstr ""
 "<replaceable>[domains]</replaceable>."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9453,20 +9436,20 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr "ПРИКЛАД ФІЛЬТРА ДОСТУПУ LDAP"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
@@ -9475,7 +9458,7 @@ msgstr ""
 "чином і використано ldap_access_order=lockout."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -9501,13 +9484,13 @@ msgstr ""
 "cache_credentials = true\n"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "ЗАУВАЖЕННЯ"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -12337,7 +12320,7 @@ msgstr ""
 "цього вузла. Назву вузла слід вказувати повністю."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (булеве значення)"
 
@@ -12357,7 +12340,7 @@ msgstr ""
 "допомогою параметра «dyndns_iface»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -12378,12 +12361,12 @@ msgstr ""
 "назву, <emphasis>dyndns_update</emphasis>, у файлі налаштувань."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -12410,12 +12393,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Типове значення: 1200 (секунд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -12448,17 +12431,17 @@ msgstr ""
 "для з’єднання LDAP IPA"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr "Приклад: dyndns_iface = em1, vnet1, vnet2"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr "dyndns_auth (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -12469,17 +12452,17 @@ msgstr ""
 "можна надсилати встановленням для цього параметра значення «none»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr "Типове значення: GSS-TSIG"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr "dyndns_auth_ptr (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -12490,7 +12473,7 @@ msgstr ""
 "оновлення можна надсилати встановленням для цього параметра значення «none»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr "Типове значення: те саме, що і dyndns_auth"
 
@@ -12525,7 +12508,7 @@ msgstr ""
 "вважатимуться резервними серверами."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (ціле число)"
 
@@ -12542,12 +12525,12 @@ msgstr ""
 "є обов’язкоми, його застосовують, лише якщо dyndns_update має значення true."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -12566,7 +12549,7 @@ msgstr ""
 "переспрямовування."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -12581,12 +12564,12 @@ msgid "Default: False (disabled)"
 msgstr "Типове значення: False (вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -12595,17 +12578,17 @@ msgstr ""
 "даними з сервером DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Типове значення: False (надати змогу nsupdate вибирати протокол)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr "dyndns_server (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
@@ -12615,7 +12598,7 @@ msgstr ""
 "параметра."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
@@ -12624,7 +12607,7 @@ msgstr ""
 "DNS відрізняється від сервера профілів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
@@ -12634,17 +12617,17 @@ msgstr ""
 "невдало."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr "Типове значення: немає (надати nsupdate змогу вибирати сервер)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr "dyndns_update_per_family (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -12817,12 +12800,12 @@ msgstr ""
 "перетворено у основний DN для виконання дій LDAP."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr "krb5_confd_path (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
@@ -12831,7 +12814,7 @@ msgstr ""
 "налаштувань Kerberos."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
@@ -12840,7 +12823,7 @@ msgstr ""
 "значення «none»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -12865,7 +12848,7 @@ msgstr ""
 "щодо профілів станції."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr "Типове значення: 5 (секунд)"
 
@@ -13773,18 +13756,16 @@ msgstr "ad_access_filter (рядок)"
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
-"Цей параметр визначає фільтр керування доступом LDAP, якому має відповідати "
-"запис користувача для того, щоб йому було надано доступ. Будь ласка, "
-"зауважте, що слід явним чином встановити для параметра «access_provider» "
-"значення «ad», щоб цей параметр почав діяти."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -13797,7 +13778,7 @@ msgstr ""
 "«FOREST» або ключове слово слід пропустити."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -13810,7 +13791,7 @@ msgstr ""
 "вказаного значенням «НАЗВА»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
@@ -13819,7 +13800,7 @@ msgstr ""
 "визначення фільтрів у базах для пошуку."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -13841,7 +13822,7 @@ msgstr ""
 "відповідності у LDAP</ulink>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -13855,7 +13836,7 @@ msgstr ""
 "специфікацією, використовуватиметься лише перший з них."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -13885,12 +13866,12 @@ msgstr ""
 "                        "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr "ad_site (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
@@ -13899,12 +13880,12 @@ msgstr ""
 "вказано, виконуватиметься спроба автоматичного визначення сайта AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr "ad_enable_gc (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -13918,7 +13899,7 @@ msgstr ""
 "SSSD встановлюватиме зв’язок лише з портом LDAP поточного сервера AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -13933,12 +13914,12 @@ msgstr ""
 "групах для різних доменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr "ad_gpo_access_control (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -13953,7 +13934,7 @@ msgstr ""
 "«access_provider» значення «ad»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -13967,7 +13948,7 @@ msgstr ""
 "<quote>ad_gpo_map</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -13981,7 +13962,7 @@ msgstr ""
 "вадами https://pagure.io/SSSD/sssd/issue/5063 ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -13996,7 +13977,7 @@ msgstr ""
 "з груп, до яких він належить, повинен мати такі права доступу до GPO:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
@@ -14005,7 +13986,7 @@ msgstr ""
 "властивостей GPO (RIGHT_DS_READ_PROPERTY)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
@@ -14014,7 +13995,7 @@ msgstr ""
 "доступ до застосування GPO (RIGHT_DS_CONTROL_ACCESS)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -14029,7 +14010,7 @@ msgstr ""
 "доступу групи Authenticated Users щодо GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -14057,12 +14038,12 @@ msgstr ""
 "manvolnum> </citerefentry>)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr "У цього параметра є три підтримуваних значення:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
@@ -14070,14 +14051,14 @@ msgstr ""
 "використовуються примусово."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 "enforcing: правила керування доступом, засновані на GPO, обробляються і "
 "використовуються примусово."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -14090,22 +14071,22 @@ msgstr ""
 "enforcing."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr "Типове значення: permissive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr "Типове значення: enforcing"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr "ad_gpo_implicit_deny (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -14124,7 +14105,7 @@ msgstr ""
 "Administrators, якщо немає правил GPO, якими надається такий доступ."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -14136,75 +14117,75 @@ msgstr ""
 "ad_gpo_implicit_deny."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr "ad_gpo_implicit_deny = False (типове значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr "allow-rules"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr "deny-rules"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr "результати"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr "missing"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr "дозволені усі користувачі"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr "present"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr "дозволені лише користувачі, яких немає у deny-rules"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr "дозволені лише користувачі, які є у allow-rules"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 "дозволені лише користувачі, які є в allow-rules і яких немає у deny-rules"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr "ad_gpo_implicit_deny = True"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr "заборонено усіх користувачів"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr "ad_gpo_ignore_unreadable (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -14219,12 +14200,12 @@ msgstr ""
 "правил груп є непридатним до читання з SSSD."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr "ad_gpo_cache_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -14235,12 +14216,12 @@ msgstr ""
 "короткого періоду часу надходить багато запитів щодо керування доступом."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr "ad_gpo_map_interactive (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -14269,7 +14250,7 @@ msgstr ""
 "правила."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
@@ -14279,7 +14260,7 @@ msgstr ""
 "вхід» («Deny log on locally»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -14289,7 +14270,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14308,42 +14289,42 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr "gdm-fingerprint"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr "lightdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr "lxdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr "sddm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr "unity"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr "xdm"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr "ad_gpo_map_remote_interactive (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -14372,7 +14353,7 @@ msgstr ""
 "одна з його груп є частиною параметрів правила."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -14384,7 +14365,7 @@ msgstr ""
 "служб віддаленої стільниці» («Deny log on through Remote Desktop Services»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -14394,7 +14375,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14413,22 +14394,22 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr "sshd"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr "cockpit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr "ad_gpo_map_network (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -14457,7 +14438,7 @@ msgstr ""
 "правила."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -14469,7 +14450,7 @@ msgstr ""
 "мережі» (Deny access to this computer from the network»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -14479,7 +14460,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14498,22 +14479,22 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr "ftp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr "samba"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr "ad_gpo_map_batch (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -14541,7 +14522,7 @@ msgstr ""
 "правила."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
@@ -14551,7 +14532,7 @@ msgstr ""
 "job») і «Заборонити вхід як пакетне завдання» («Deny log on as a batch job»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -14561,7 +14542,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14580,24 +14561,24 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 "Зауваження: назва служби cron у різних дистрибутивах Linux може бути різною."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr "crond"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr "ad_gpo_map_service (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -14626,7 +14607,7 @@ msgstr ""
 "принаймні одна з його груп є частиною параметрів правила."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
@@ -14636,7 +14617,7 @@ msgstr ""
 "«Заборонити вхід як службу» («Deny log on as a service»)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -14646,7 +14627,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -14663,12 +14644,12 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr "ad_gpo_map_permit (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
@@ -14677,7 +14658,7 @@ msgstr ""
 "основі GPO, незалежно від будь-яких прав входу GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -14687,7 +14668,7 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -14706,22 +14687,22 @@ msgstr ""
 "type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr "polkit-1"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr "systemd-user"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr "ad_gpo_map_deny (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
@@ -14730,7 +14711,7 @@ msgstr ""
 "на основі GPO, незалежно від будь-яких прав входу GPO."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -14740,12 +14721,12 @@ msgstr ""
 "                            "
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr "ad_gpo_default_right (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -14767,52 +14748,52 @@ msgstr ""
 "забороняла доступ для непов’язаних назв служб PAM."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr "Передбачені значення для цього параметра:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr "remote_interactive"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr "network"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr "batch"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr "service"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr "permit"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr "deny"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr "Типове значення: deny"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr "ad_maximum_machine_account_password_age (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -14823,17 +14804,17 @@ msgstr ""
 "Значення 0 вимкне спроби оновлення."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr "Типове значення: 30 днів"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr "ad_machine_account_password_renewal_opts (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -14848,17 +14829,17 @@ msgstr ""
 "— визначає початковий час очікування на перший запуск завдання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr "Типове значення: 86400:750 (24 годин і 15 хвилин)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr "ad_update_samba_machine_account_password (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -14871,12 +14852,12 @@ msgstr ""
 "налаштовано на використання AD для розпізнавання."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr "ad_use_ldaps (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -14894,12 +14875,12 @@ msgstr ""
 "з'єднань буде встановлено у значення 0 (нуль)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr "ad_allow_remote_domain_local_groups (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -14916,7 +14897,7 @@ msgstr ""
 "роблять користувачів і групи AD доступними у клієнті Linux."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -14940,7 +14921,7 @@ msgstr ""
 "запитах tokenGroups, де також немає віддалених груп локальних доменів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -14960,7 +14941,7 @@ msgstr ""
 "локальні групи домену може бути знайдено лише на глибшому рівні вкладеності."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -14977,12 +14958,12 @@ msgstr ""
 "якщо цю адресу не було змінено за допомогою параметра «dyndns_iface»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr "Типове значення: 3600 (секунд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
@@ -14991,7 +14972,7 @@ msgstr ""
 "для з’єднання LDAP AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -15008,7 +14989,7 @@ msgstr ""
 "значення."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -15019,7 +15000,7 @@ msgstr ""
 "У прикладі продемонстровано лише параметри доступу, специфічні для засобу AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -15043,7 +15024,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -15055,7 +15036,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -15067,7 +15048,7 @@ msgstr ""
 "id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -15082,7 +15063,7 @@ msgstr ""
 "шифрування) вручну."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -15727,60 +15708,73 @@ msgstr ""
 "застосуванням є тестування служби. Сигнал може бути надіслано або процесу "
 "sssd, або процесу sssd_be безпосередньо."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr "СТАН ВИХОДУ"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr "0"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr "SSSD завершив роботу штатно."
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr "1"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr "Помилкові налаштування або помилковий параметр командного рядка."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr "2"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr "Помилка розподілу пам'яті."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr "6"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr "SSSD вже запущено."
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr "Інші коди"
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
@@ -15789,7 +15783,7 @@ msgstr ""
 "потрібних прав доступу. Див. журнали SSSD і системи, щоб дізнатися більше."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
@@ -15798,7 +15792,7 @@ msgstr ""
 "клієнтські програми не використовуватимуть fast у кеші у пам’яті."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -18110,9 +18104,12 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
 #: sss_ssh_knownhosts.1.xml:47
-#, no-wrap
+#, fuzzy, no-wrap
+#| msgid ""
+#| "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+#| "            "
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 "              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
@@ -18143,8 +18140,59 @@ msgid ""
 msgstr ""
 "Шукати відкриті ключі вузлів у домені SSSD <replaceable>ДОМЕН</replaceable>."
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+#, fuzzy
+#| msgid "<option>-H</option>,<option>--ssh-hosts</option>"
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr "<option>-H</option>,<option>--ssh-hosts</option>"
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -22600,6 +22648,45 @@ msgstr ""
 
 #. type: Content of: <refsect1><para>
 #: include/seealso.xml:4
+#, fuzzy
+#| msgid ""
+#| "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</"
+#| "manvolnum> </citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ldap-attributes</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-krb5</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-simple</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd-ipa</refentrytitle><manvolnum>5</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sssd-ad</"
+#| "refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <phrase "
+#| "condition=\"with_files_provider\"> <citerefentry> <refentrytitle>sssd-"
+#| "files</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+#| "<phrase condition=\"with_sudo\"> <citerefentry> <refentrytitle>sssd-sudo</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, </phrase> "
+#| "<citerefentry> <refentrytitle>sssd-session-recording</refentrytitle> "
+#| "<manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_cache</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sss_debuglevel</"
+#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_obfuscate</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>, <citerefentry> <refentrytitle>sss_seed</"
+#| "refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle><manvolnum>8</"
+#| "manvolnum> </citerefentry>, <phrase condition=\"with_ssh\"> "
+#| "<citerefentry> <refentrytitle>sss_ssh_authorizedkeys</refentrytitle> "
+#| "<manvolnum>1</manvolnum> </citerefentry>, <citerefentry> "
+#| "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</"
+#| "manvolnum> </citerefentry>, </phrase> <phrase condition=\"with_ifp\"> "
+#| "<citerefentry> <refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</"
+#| "manvolnum> </citerefentry>, </phrase> <citerefentry> "
+#| "<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+#| "citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> <phrase "
+#| "condition=\"with_stap\"> <citerefentry> <refentrytitle>sssd-systemtap</"
+#| "refentrytitle> <manvolnum>5</manvolnum> </citerefentry> </phrase>"
 msgid ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
 "citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
@@ -22630,14 +22717,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 "<citerefentry> <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum> </"
 "citerefentry>, <citerefentry> <refentrytitle>sssd.conf</"
@@ -23333,23 +23419,41 @@ msgstr ""
 "Визначає, чи слід перетворювати реєстраційний запис вузла і користувача у "
 "канонічну форму. Цю можливість передбачено з версії MIT Kerberos 1.7."
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
-msgid ""
-"If a Certificate Revocation List (CRL)  is expired ignore the CRL checks for "
-"the related certificates. This option should be used to allow authentication "
-"when the system is offline and the CRL cannot be renewed."
-msgstr ""
-"Якщо строк дії списку відкликання сертифікатів (CRL) вичерпано, перевірки "
-"CRL для відповідних сертифікатів буде проігноровано. Цим параметром слід "
-"користуватися для уможливлення розпізнавання у системах, які працюють у "
-"автономному режимі, коли оновлення CRL є неможливим."
+#~ msgid "reconnection_retries (integer)"
+#~ msgstr "reconnection_retries (ціле число)"
 
-#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2684
-msgid "Feature is only supported for domains with id_provider = ldap."
-msgstr ""
-"Підтримку можливості передбачено лише для доменів з id_provider = ldap."
+#~ msgid ""
+#~ "Number of times services should attempt to reconnect in the event of a "
+#~ "Data Provider crash or restart before they give up"
+#~ msgstr ""
+#~ "Кількість повторних спроб встановлення зв’язку зі службами або їх "
+#~ "перезапуску у разі аварійного завершення роботи інструменту надання даних "
+#~ "до визнання подальших спроб безнадійними."
+
+#~ msgid ""
+#~ "This option specifies LDAP access control filter that the user must match "
+#~ "in order to be allowed access. Please note that the "
+#~ "<quote>access_provider</quote> option must be explicitly set to "
+#~ "<quote>ad</quote> in order for this option to have an effect."
+#~ msgstr ""
+#~ "Цей параметр визначає фільтр керування доступом LDAP, якому має "
+#~ "відповідати запис користувача для того, щоб йому було надано доступ. Будь "
+#~ "ласка, зауважте, що слід явним чином встановити для параметра "
+#~ "«access_provider» значення «ad», щоб цей параметр почав діяти."
+
+#~ msgid ""
+#~ "If a Certificate Revocation List (CRL)  is expired ignore the CRL checks "
+#~ "for the related certificates. This option should be used to allow "
+#~ "authentication when the system is offline and the CRL cannot be renewed."
+#~ msgstr ""
+#~ "Якщо строк дії списку відкликання сертифікатів (CRL) вичерпано, перевірки "
+#~ "CRL для відповідних сертифікатів буде проігноровано. Цим параметром слід "
+#~ "користуватися для уможливлення розпізнавання у системах, які працюють у "
+#~ "автономному режимі, коли оновлення CRL є неможливим."
+
+#~ msgid "Feature is only supported for domains with id_provider = ldap."
+#~ msgstr ""
+#~ "Підтримку можливості передбачено лише для доменів з id_provider = ldap."
 
 #~ msgid ""
 #~ "<filename>sssd.conf</filename> must be a regular file that is owned, "
diff --git a/src/man/po/zh_CN.po b/src/man/po/zh_CN.po
index 7bb367dc288..ba631edf9f3 100644
--- a/src/man/po/zh_CN.po
+++ b/src/man/po/zh_CN.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 2.3.0\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2024-06-25 13:25+0200\n"
+"POT-Creation-Date: 2024-10-15 11:44+0200\n"
 "PO-Revision-Date: 2020-07-22 07:51-0400\n"
 "Last-Translator: Copied by Zanata <copied-by-zanata@zanata.org>\n"
 "Language-Team: Chinese (China) (http://www.transifex.com/projects/p/sssd/"
@@ -211,13 +211,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:352
-#: sssd.conf.5.xml:712 sssd.conf.5.xml:727 sssd.conf.5.xml:950
-#: sssd.conf.5.xml:1068 sssd.conf.5.xml:2196 sssd-ldap.5.xml:919
-#: sssd-ldap.5.xml:1073 sssd-ldap.5.xml:1176 sssd-ldap.5.xml:1245
-#: sssd-ldap.5.xml:1652 sssd-ldap.5.xml:1767 sssd-ldap.5.xml:1832
-#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:366 sssd-ad.5.xml:1200
-#: sssd-ad.5.xml:1353 sssd-krb5.5.xml:358
+#: sssd.conf.5.xml:139 sssd.conf.5.xml:176 sssd.conf.5.xml:338
+#: sssd.conf.5.xml:698 sssd.conf.5.xml:713 sssd.conf.5.xml:923
+#: sssd.conf.5.xml:1041 sssd.conf.5.xml:2169 sssd-ldap.5.xml:920
+#: sssd-ldap.5.xml:1074 sssd-ldap.5.xml:1177 sssd-ldap.5.xml:1246
+#: sssd-ldap.5.xml:1654 sssd-ldap.5.xml:1788 sssd-ldap.5.xml:1853
+#: sssd-ipa.5.xml:347 sssd-ad.5.xml:252 sssd-ad.5.xml:367 sssd-ad.5.xml:1201
+#: sssd-ad.5.xml:1354 sssd-krb5.5.xml:358
 msgid "Default: true"
 msgstr ""
 
@@ -234,11 +234,11 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:152 sssd.conf.5.xml:650 sssd.conf.5.xml:947
-#: sssd.conf.5.xml:2099 sssd.conf.5.xml:2166 sssd.conf.5.xml:4258
-#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:938 sssd-ldap.5.xml:1148
-#: sssd-ldap.5.xml:1601 sssd-ldap.5.xml:1856 sssd-ipa.5.xml:152
-#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1106 sssd-krb5.5.xml:268
+#: sssd.conf.5.xml:152 sssd.conf.5.xml:636 sssd.conf.5.xml:920
+#: sssd.conf.5.xml:2072 sssd.conf.5.xml:2139 sssd.conf.5.xml:4231
+#: sssd-ldap.5.xml:313 sssd-ldap.5.xml:939 sssd-ldap.5.xml:1149
+#: sssd-ldap.5.xml:1603 sssd-ldap.5.xml:1877 sssd-ipa.5.xml:152
+#: sssd-ipa.5.xml:254 sssd-ipa.5.xml:662 sssd-ad.5.xml:1107 sssd-krb5.5.xml:268
 #: sssd-krb5.5.xml:330 sssd-krb5.5.xml:432 include/krb5_options.xml:163
 msgid "Default: false"
 msgstr ""
@@ -271,8 +271,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
-#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1673
-#: sssd-ldap.5.xml:1879 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
+#: sssd.conf.5.xml:112 sssd.conf.5.xml:187 sssd-ldap.5.xml:1694
+#: sssd-ldap.5.xml:1900 sss-certmap.5.xml:645 sssd-systemtap.5.xml:82
 #: sssd-systemtap.5.xml:143 sssd-systemtap.5.xml:236 sssd-systemtap.5.xml:274
 #: sssd-systemtap.5.xml:330 sssd-ldap-attributes.5.xml:40
 #: sssd-ldap-attributes.5.xml:661 sssd-ldap-attributes.5.xml:803
@@ -302,8 +302,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:199 sssd.conf.5.xml:1288 sssd.conf.5.xml:1765
-#: sssd.conf.5.xml:4274 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
+#: sssd.conf.5.xml:199 sssd.conf.5.xml:1261 sssd.conf.5.xml:1738
+#: sssd.conf.5.xml:4247 sssd-ldap.5.xml:766 include/ldap_id_mapping.xml:270
 msgid "Default: 10"
 msgstr ""
 
@@ -339,46 +339,27 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:235
 msgid ""
-"Supported services: nss, pam <phrase condition=\"with_sudo\">, sudo</phrase> "
-"<phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
+"Supported services: nss, pam, ifp <phrase condition=\"with_sudo\">, sudo</"
+"phrase> <phrase condition=\"with_autofs\">, autofs</phrase> <phrase "
 "condition=\"with_ssh\">, ssh</phrase> <phrase "
-"condition=\"with_pac_responder\">, pac</phrase> <phrase "
-"condition=\"with_ifp\">, ifp</phrase>"
+"condition=\"with_pac_responder\">, pac</phrase>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:243
+#: sssd.conf.5.xml:242
 msgid ""
 "<phrase condition=\"have_systemd\"> By default, all services are disabled "
 "and the administrator must enable the ones allowed to be used by executing: "
 "\"systemctl enable sssd-@service@.socket\".  </phrase>"
 msgstr ""
 
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:252 sssd.conf.5.xml:782
-msgid "reconnection_retries (integer)"
-msgstr ""
-
-#. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:255 sssd.conf.5.xml:785
-msgid ""
-"Number of times services should attempt to reconnect in the event of a Data "
-"Provider crash or restart before they give up"
-msgstr ""
-
-#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:260 sssd.conf.5.xml:790 sssd.conf.5.xml:3730
-#: include/failover.xml:100
-msgid "Default: 3"
-msgstr "默认： 3"
-
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:265
+#: sssd.conf.5.xml:251
 msgid "domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:268
+#: sssd.conf.5.xml:254
 msgid ""
 "A domain is a database containing user information. SSSD can use more "
 "domains at the same time, but at least one must be configured or SSSD won't "
@@ -389,19 +370,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:281 sssd.conf.5.xml:3562
+#: sssd.conf.5.xml:267 sssd.conf.5.xml:3535
 msgid "re_expression (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:284
+#: sssd.conf.5.xml:270
 msgid ""
 "Default regular expression that describes how to parse the string containing "
 "user name and domain into these components."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:289
+#: sssd.conf.5.xml:275
 msgid ""
 "Each domain can have an individual regular expression configured. For some "
 "ID providers there are also default regular expressions. See DOMAIN SECTIONS "
@@ -409,12 +390,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:298 sssd.conf.5.xml:3619
+#: sssd.conf.5.xml:284 sssd.conf.5.xml:3592
 msgid "full_name_format (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:301 sssd.conf.5.xml:3622
+#: sssd.conf.5.xml:287 sssd.conf.5.xml:3595
 msgid ""
 "A <citerefentry> <refentrytitle>printf</refentrytitle> <manvolnum>3</"
 "manvolnum> </citerefentry>-compatible format that describes how to compose a "
@@ -422,70 +403,70 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:312 sssd.conf.5.xml:3633
+#: sssd.conf.5.xml:298 sssd.conf.5.xml:3606
 msgid "%1$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:313 sssd.conf.5.xml:3634
+#: sssd.conf.5.xml:299 sssd.conf.5.xml:3607
 msgid "user name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:316 sssd.conf.5.xml:3637
+#: sssd.conf.5.xml:302 sssd.conf.5.xml:3610
 msgid "%2$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:319 sssd.conf.5.xml:3640
+#: sssd.conf.5.xml:305 sssd.conf.5.xml:3613
 msgid "domain name as specified in the SSSD config file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:325 sssd.conf.5.xml:3646
+#: sssd.conf.5.xml:311 sssd.conf.5.xml:3619
 msgid "%3$s"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:328 sssd.conf.5.xml:3649
+#: sssd.conf.5.xml:314 sssd.conf.5.xml:3622
 msgid ""
 "domain flat name. Mostly usable for Active Directory domains, both directly "
 "configured or discovered via IPA trusts."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:309 sssd.conf.5.xml:3630
+#: sssd.conf.5.xml:295 sssd.conf.5.xml:3603
 msgid ""
 "The following expansions are supported: <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:338
+#: sssd.conf.5.xml:324
 msgid ""
 "Each domain can have an individual format string configured.  See DOMAIN "
 "SECTIONS for more info on this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:344
+#: sssd.conf.5.xml:330
 msgid "monitor_resolv_conf (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:347
+#: sssd.conf.5.xml:333
 msgid ""
 "Controls if SSSD should monitor the state of resolv.conf to identify when it "
 "needs to update its internal DNS resolver."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:357
+#: sssd.conf.5.xml:343
 msgid "try_inotify (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:360
+#: sssd.conf.5.xml:346
 msgid ""
 "By default, SSSD will attempt to use inotify to monitor configuration files "
 "changes and will fall back to polling every five seconds if inotify cannot "
@@ -493,7 +474,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:366
+#: sssd.conf.5.xml:352
 msgid ""
 "There are some limited situations where it is preferred that we should skip "
 "even trying to use inotify. In these rare cases, this option should be set "
@@ -501,52 +482,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:372
+#: sssd.conf.5.xml:358
 msgid ""
 "Default: true on platforms where inotify is supported. False on other "
 "platforms."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:376
+#: sssd.conf.5.xml:362
 msgid ""
 "Note: this option will have no effect on platforms where inotify is "
 "unavailable. On these platforms, polling will always be used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:383
+#: sssd.conf.5.xml:369
 msgid "krb5_rcache_dir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:386
+#: sssd.conf.5.xml:372
 msgid ""
 "Directory on the filesystem where SSSD should store Kerberos replay cache "
 "files."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:390
+#: sssd.conf.5.xml:376
 msgid ""
 "This option accepts a special value __LIBKRB5_DEFAULTS__ that will instruct "
 "SSSD to let libkrb5 decide the appropriate location for the replay cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:396
+#: sssd.conf.5.xml:382
 msgid ""
 "Default: Distribution-specific and specified at build-time. "
 "(__LIBKRB5_DEFAULTS__ if not configured)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:403
+#: sssd.conf.5.xml:389
 msgid "user (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:406
+#: sssd.conf.5.xml:392
 msgid ""
 "A legacy (deprecated) method to configure the user to drop the privileges to "
 "where appropriate to avoid running as the root user.  The only supported "
@@ -554,14 +535,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:413
+#: sssd.conf.5.xml:399
 msgid ""
 "This option is ignored if main SSSD process is started under non-root user "
 "initially (preferred method)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:418
+#: sssd.conf.5.xml:404
 msgid ""
 "This option doesn't apply to socket activated services, as in this case the "
 "user to run the processes is configured in systemd service files.  Keep in "
@@ -571,17 +552,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:429
+#: sssd.conf.5.xml:415
 msgid "Default: not set, process will run as root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:434
+#: sssd.conf.5.xml:420
 msgid "default_domain_suffix (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:437
+#: sssd.conf.5.xml:423
 msgid ""
 "This string will be used as a default domain name for all names without a "
 "domain name component. The main use case is environments where the primary "
@@ -591,7 +572,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:447
+#: sssd.conf.5.xml:433
 msgid ""
 "Please note that if this option is set all users from the primary domain "
 "have to use their fully qualified name, e.g. user@domain.name, to log in. "
@@ -604,8 +585,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:464 sssd-ldap.5.xml:877 sssd-ldap.5.xml:889
-#: sssd-ldap.5.xml:982 sssd-ad.5.xml:920 sssd-ad.5.xml:995 sssd-krb5.5.xml:468
+#: sssd.conf.5.xml:450 sssd-ldap.5.xml:878 sssd-ldap.5.xml:890
+#: sssd-ldap.5.xml:983 sssd-ad.5.xml:921 sssd-ad.5.xml:996 sssd-krb5.5.xml:468
 #: sssd-ldap-attributes.5.xml:470 sssd-ldap-attributes.5.xml:978
 #: include/ldap_id_mapping.xml:211 include/ldap_id_mapping.xml:222
 #: include/krb5_options.xml:148
@@ -613,12 +594,12 @@ msgid "Default: not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:469
+#: sssd.conf.5.xml:455
 msgid "override_space (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:472
+#: sssd.conf.5.xml:458
 msgid ""
 "This parameter will replace spaces (space bar)  with the given character for "
 "user and group names.  e.g. (_). User name &quot;john doe&quot; will be "
@@ -628,7 +609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:481
+#: sssd.conf.5.xml:467
 msgid ""
 "Please note it is a configuration error to use a replacement character that "
 "might be used in user or group names. If a name contains the replacement "
@@ -637,22 +618,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:489
+#: sssd.conf.5.xml:475
 msgid "Default: not set (spaces will not be replaced)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:494
+#: sssd.conf.5.xml:480
 msgid "certificate_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:502
+#: sssd.conf.5.xml:488
 msgid "no_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:504
+#: sssd.conf.5.xml:490
 msgid ""
 "Disables Online Certificate Status Protocol (OCSP) checks. This might be "
 "needed if the OCSP servers defined in the certificate are not reachable from "
@@ -660,12 +641,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:512
+#: sssd.conf.5.xml:498
 msgid "soft_ocsp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:514
+#: sssd.conf.5.xml:500
 msgid ""
 "If a connection cannot be established to an OCSP responder the OCSP check is "
 "skipped.  This option should be used to allow authentication when the system "
@@ -673,61 +654,61 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:524
+#: sssd.conf.5.xml:510
 msgid "ocsp_dgst"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:526
+#: sssd.conf.5.xml:512
 msgid ""
 "Digest (hash) function used to create the certificate ID for the OCSP "
 "request. Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:530
+#: sssd.conf.5.xml:516
 msgid "sha1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:531
+#: sssd.conf.5.xml:517
 msgid "sha256"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:532
+#: sssd.conf.5.xml:518
 msgid "sha384"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:533
+#: sssd.conf.5.xml:519
 msgid "sha512"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:536
+#: sssd.conf.5.xml:522
 msgid "Default: sha1 (to allow compatibility with RFC5019-compliant responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:542
+#: sssd.conf.5.xml:528
 msgid "no_verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:544
+#: sssd.conf.5.xml:530
 msgid ""
 "Disables verification completely.  This option should only be used for "
 "testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:550
+#: sssd.conf.5.xml:536
 msgid "partial_chain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:552
+#: sssd.conf.5.xml:538
 msgid ""
 "Allow verification to succeed even if a <replaceable>complete</replaceable> "
 "chain cannot be built to a self-signed trust-anchor, provided it is possible "
@@ -735,12 +716,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:561
+#: sssd.conf.5.xml:547
 msgid "ocsp_default_responder=URL"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:563
+#: sssd.conf.5.xml:549
 msgid ""
 "Sets the OCSP default responder which should be used instead of the one "
 "mentioned in the certificate. URL must be replaced with the URL of the OCSP "
@@ -748,24 +729,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:573
+#: sssd.conf.5.xml:559
 msgid "ocsp_default_responder_signing_cert=NAME"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:575
+#: sssd.conf.5.xml:561
 msgid ""
 "This option is currently ignored. All needed certificates must be available "
 "in the PEM file given by pam_cert_db_path."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:583
+#: sssd.conf.5.xml:569
 msgid "crl_file=/PATH/TO/CRL/FILE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:585
+#: sssd.conf.5.xml:571
 msgid ""
 "Use the Certificate Revocation List (CRL) from the given file during the "
 "verification of the certificate. The CRL must be given in PEM format, see "
@@ -774,12 +755,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:598
+#: sssd.conf.5.xml:584
 msgid "soft_crl"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:601
+#: sssd.conf.5.xml:587
 msgid ""
 "If a Certificate Revocation List (CRL)  is expired ignore the expiration "
 "time of the CRL and check the related certificates with the expired CRL. "
@@ -788,7 +769,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:497
+#: sssd.conf.5.xml:483
 msgid ""
 "With this parameter the certificate verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -796,58 +777,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:614
+#: sssd.conf.5.xml:600
 msgid "Unknown options are reported but ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:617
+#: sssd.conf.5.xml:603
 msgid "Default: not set, i.e. do not restrict certificate verification"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:623
+#: sssd.conf.5.xml:609
 msgid "disable_netlink (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:626
+#: sssd.conf.5.xml:612
 msgid ""
 "SSSD hooks into the netlink interface to monitor changes to routes, "
 "addresses, links and trigger certain actions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:631
+#: sssd.conf.5.xml:617
 msgid ""
 "The SSSD state changes caused by netlink events may be undesirable and can "
 "be disabled by setting this option to 'true'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:636
+#: sssd.conf.5.xml:622
 msgid "Default: false (netlink changes are detected)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:641
+#: sssd.conf.5.xml:627
 msgid "enable_files_domain (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:644
+#: sssd.conf.5.xml:630
 msgid ""
 "When this option is enabled, SSSD prepends an implicit domain with "
 "<quote>id_provider=files</quote> before any explicitly configured domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:655
+#: sssd.conf.5.xml:641
 msgid "domain_resolution_order"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:658
+#: sssd.conf.5.xml:644
 msgid ""
 "Comma separated list of domains and subdomains representing the lookup order "
 "that will be followed.  The list doesn't have to include all possible "
@@ -858,7 +839,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:670
+#: sssd.conf.5.xml:656
 msgid ""
 "Please, note that when this option is set the output format of all commands "
 "is always fully-qualified even when using short names for input <phrase "
@@ -876,18 +857,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:698 sssd.conf.5.xml:1789 sssd.conf.5.xml:4324
-#: sssd-ad.5.xml:187 sssd-ad.5.xml:327 sssd-ad.5.xml:341
+#: sssd.conf.5.xml:684 sssd.conf.5.xml:1762 sssd.conf.5.xml:4297
+#: sssd-ad.5.xml:187 sssd-ad.5.xml:328 sssd-ad.5.xml:342
 msgid "Default: Not set"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:703
+#: sssd.conf.5.xml:689
 msgid "implicit_pac_responder (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:706
+#: sssd.conf.5.xml:692
 msgid ""
 "The PAC responder is enabled automatically for the IPA and AD provider to "
 "evaluate and check the PAC. If it has to be disabled set this option to "
@@ -895,12 +876,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:717
+#: sssd.conf.5.xml:703
 msgid "core_dumpable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:720
+#: sssd.conf.5.xml:706
 msgid ""
 "This option can be used for general system hardening: setting it to 'false' "
 "forbids core dumps for all SSSD processes to avoid leaking plain text "
@@ -908,24 +889,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:732
+#: sssd.conf.5.xml:718
 msgid "passkey_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:740
+#: sssd.conf.5.xml:726
 msgid "user_verification (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:742
+#: sssd.conf.5.xml:728
 msgid ""
 "Enable or disable the user verification (i.e. PIN, fingerprint)  during "
 "authentication. If enabled, the PIN will always be requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:748
+#: sssd.conf.5.xml:734
 msgid ""
 "The default is that the key settings decide what to do. In the IPA or "
 "kerberos pre-authentication case, this value will be overwritten by the "
@@ -933,7 +914,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:735
+#: sssd.conf.5.xml:721
 msgid ""
 "With this parameter the passkey verification can be tuned with a comma "
 "separated list of options. Supported options are: <placeholder "
@@ -952,12 +933,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:767
+#: sssd.conf.5.xml:753
 msgid "SERVICES SECTIONS"
 msgstr "服务部分"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:769
+#: sssd.conf.5.xml:755
 msgid ""
 "Settings that can be used to configure different services are described in "
 "this section. They should reside in the [<replaceable>$NAME</replaceable>] "
@@ -966,22 +947,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:776
+#: sssd.conf.5.xml:762
 msgid "General service configuration options"
 msgstr "基本服务配置选项"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:778
+#: sssd.conf.5.xml:764
 msgid "These options can be used to configure any service."
 msgstr "这些选项可被用于配置任何服务。"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:795
+#: sssd.conf.5.xml:768
 msgid "fd_limit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:798
+#: sssd.conf.5.xml:771
 msgid ""
 "This option specifies the maximum number of file descriptors that may be "
 "opened at one time by this SSSD process. On systems where SSSD is granted "
@@ -991,17 +972,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:807
+#: sssd.conf.5.xml:780
 msgid "Default: 8192 (or limits.conf \"hard\" limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:812
+#: sssd.conf.5.xml:785
 msgid "client_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:815
+#: sssd.conf.5.xml:788
 msgid ""
 "This option specifies the number of seconds that a client of an SSSD process "
 "can hold onto a file descriptor without communicating on it. This value is "
@@ -1011,19 +992,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:824
+#: sssd.conf.5.xml:797
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 60, KCM: 300"
 msgstr "默认： 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:829
+#: sssd.conf.5.xml:802
 msgid "offline_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:832
+#: sssd.conf.5.xml:805
 msgid ""
 "When SSSD switches to offline mode the amount of time before it tries to go "
 "back online will increase based upon the time spent disconnected.  By "
@@ -1034,14 +1015,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:843 sssd.conf.5.xml:899
+#: sssd.conf.5.xml:816 sssd.conf.5.xml:872
 msgid ""
 "new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0..."
 "offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:846
+#: sssd.conf.5.xml:819
 msgid ""
 "The offline_timeout default value is 60.  The offline_timeout_max default "
 "value is 3600.  The offline_timeout_random_offset default value is 30.  The "
@@ -1049,44 +1030,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:852
+#: sssd.conf.5.xml:825
 msgid ""
 "Note that the maximum length of each interval is defined by "
 "offline_timeout_max (apart of random part)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:856 sssd.conf.5.xml:1199 sssd.conf.5.xml:1582
-#: sssd.conf.5.xml:1878 sssd-ldap.5.xml:495
+#: sssd.conf.5.xml:829 sssd.conf.5.xml:1172 sssd.conf.5.xml:1555
+#: sssd.conf.5.xml:1851 sssd-ldap.5.xml:495
 msgid "Default: 60"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:861
+#: sssd.conf.5.xml:834
 msgid "offline_timeout_max (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:864
+#: sssd.conf.5.xml:837
 msgid ""
 "Controls by how much the time between attempts to go online can be "
 "incremented following unsuccessful attempts to go online."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:869
+#: sssd.conf.5.xml:842
 msgid "A value of 0 disables the incrementing behaviour."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:872
+#: sssd.conf.5.xml:845
 msgid ""
 "The value of this parameter should be set in correlation to offline_timeout "
 "parameter value."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:876
+#: sssd.conf.5.xml:849
 msgid ""
 "With offline_timeout set to 60 (default value) there is no point in setting "
 "offlinet_timeout_max to less than 120 as it will saturate instantly. General "
@@ -1095,62 +1076,62 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:882
+#: sssd.conf.5.xml:855
 msgid ""
 "Although a value between 0 and offline_timeout may be specified, it has the "
 "effect of overriding the offline_timeout value so is of little use."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:887
+#: sssd.conf.5.xml:860
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 3600"
 msgstr "默认： 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:892
+#: sssd.conf.5.xml:865
 msgid "offline_timeout_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:895
+#: sssd.conf.5.xml:868
 msgid ""
 "When SSSD is in offline mode it keeps probing backend servers in specified "
 "time intervals:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:902
+#: sssd.conf.5.xml:875
 msgid ""
 "This parameter controls the value of the random offset used for the above "
 "equation. Final random_offset value will be random number in range:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:907
+#: sssd.conf.5.xml:880
 msgid "[0 - offline_timeout_random_offset]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:910
+#: sssd.conf.5.xml:883
 msgid "A value of 0 disables the random offset addition."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:913
+#: sssd.conf.5.xml:886
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 30"
 msgstr "默认： 3"
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:918
+#: sssd.conf.5.xml:891
 msgid "responder_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:921
+#: sssd.conf.5.xml:894
 msgid ""
 "This option specifies the number of seconds that an SSSD responder process "
 "can be up without being used. This value is limited in order to avoid "
@@ -1162,58 +1143,58 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:935 sssd.conf.5.xml:1212 sssd.conf.5.xml:2331
+#: sssd.conf.5.xml:908 sssd.conf.5.xml:1185 sssd.conf.5.xml:2304
 #: sssd-ldap.5.xml:332
 msgid "Default: 300"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:940
+#: sssd.conf.5.xml:913
 msgid "cache_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:943
+#: sssd.conf.5.xml:916
 msgid ""
 "This option specifies whether the responder should query all caches before "
 "querying the Data Providers."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:958
+#: sssd.conf.5.xml:931
 msgid "NSS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:960
+#: sssd.conf.5.xml:933
 msgid ""
 "These options can be used to configure the Name Service Switch (NSS) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:965
+#: sssd.conf.5.xml:938
 msgid "enum_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:968
+#: sssd.conf.5.xml:941
 msgid ""
 "How many seconds should nss_sss cache enumerations (requests for info about "
 "all users)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:972
+#: sssd.conf.5.xml:945
 msgid "Default: 120"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:977
+#: sssd.conf.5.xml:950
 msgid "entry_cache_nowait_percentage (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:980
+#: sssd.conf.5.xml:953
 msgid ""
 "The entry cache can be set to automatically update entries in the background "
 "if they are requested beyond a percentage of the entry_cache_timeout value "
@@ -1221,7 +1202,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:986
+#: sssd.conf.5.xml:959
 msgid ""
 "For example, if the domain's entry_cache_timeout is set to 30s and "
 "entry_cache_nowait_percentage is set to 50 (percent), entries that come in "
@@ -1231,7 +1212,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:996
+#: sssd.conf.5.xml:969
 msgid ""
 "Valid values for this option are 0-99 and represent a percentage of the "
 "entry_cache_timeout for each domain. For performance reasons, this "
@@ -1240,17 +1221,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1004 sssd.conf.5.xml:2120
+#: sssd.conf.5.xml:977 sssd.conf.5.xml:2093
 msgid "Default: 50"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1009
+#: sssd.conf.5.xml:982
 msgid "entry_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1012
+#: sssd.conf.5.xml:985
 msgid ""
 "Specifies for how many seconds nss_sss should cache negative cache hits "
 "(that is, queries for invalid database entries, like nonexistent ones)  "
@@ -1258,17 +1239,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1018 sssd.conf.5.xml:1777 sssd.conf.5.xml:2144
+#: sssd.conf.5.xml:991 sssd.conf.5.xml:1750 sssd.conf.5.xml:2117
 msgid "Default: 15"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1023
+#: sssd.conf.5.xml:996
 msgid "local_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1026
+#: sssd.conf.5.xml:999
 msgid ""
 "Specifies for how many seconds nss_sss should keep local users and groups in "
 "negative cache before trying to look it up in the back end again. Setting "
@@ -1276,17 +1257,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1032
+#: sssd.conf.5.xml:1005
 msgid "Default: 14400 (4 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1037
+#: sssd.conf.5.xml:1010
 msgid "filter_users, filter_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1040
+#: sssd.conf.5.xml:1013
 msgid ""
 "Exclude certain users or groups from being fetched from the sss NSS "
 "database. This is particularly useful for system accounts. This option can "
@@ -1295,7 +1276,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1048
+#: sssd.conf.5.xml:1021
 msgid ""
 "NOTE: The filter_groups option doesn't affect inheritance of nested group "
 "members, since filtering happens after they are propagated for returning via "
@@ -1304,41 +1285,41 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1056
+#: sssd.conf.5.xml:1029
 msgid "Default: root"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1061
+#: sssd.conf.5.xml:1034
 msgid "filter_users_in_groups (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1064
+#: sssd.conf.5.xml:1037
 msgid ""
 "If you want filtered user still be group members set this option to false."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1075
+#: sssd.conf.5.xml:1048
 msgid "fallback_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1078
+#: sssd.conf.5.xml:1051
 msgid ""
 "Set a default template for a user's home directory if one is not specified "
 "explicitly by the domain's data provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1083
+#: sssd.conf.5.xml:1056
 msgid ""
 "The available values for this option are the same as for override_homedir."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1089
+#: sssd.conf.5.xml:1062
 #, no-wrap
 msgid ""
 "fallback_homedir = /home/%u\n"
@@ -1346,23 +1327,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para>
-#: sssd.conf.5.xml:1087 sssd.conf.5.xml:1649 sssd.conf.5.xml:1668
-#: sssd.conf.5.xml:1745 sssd-krb5.5.xml:451 include/override_homedir.xml:66
+#: sssd.conf.5.xml:1060 sssd.conf.5.xml:1622 sssd.conf.5.xml:1641
+#: sssd.conf.5.xml:1718 sssd-krb5.5.xml:451 include/override_homedir.xml:66
 msgid "example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1093
+#: sssd.conf.5.xml:1066
 msgid "Default: not set (no substitution for unset home directories)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1099
+#: sssd.conf.5.xml:1072
 msgid "override_shell (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1102
+#: sssd.conf.5.xml:1075
 msgid ""
 "Override the login shell for all users. This option supersedes any other "
 "shell options if it takes effect and can be set either in the [nss] section "
@@ -1370,47 +1351,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1108
+#: sssd.conf.5.xml:1081
 msgid "Default: not set (SSSD will use the value retrieved from LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1114
+#: sssd.conf.5.xml:1087
 msgid "allowed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1117
+#: sssd.conf.5.xml:1090
 msgid ""
 "Restrict user shell to one of the listed values. The order of evaluation is:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1120
+#: sssd.conf.5.xml:1093
 msgid "1. If the shell is present in <quote>/etc/shells</quote>, it is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1124
+#: sssd.conf.5.xml:1097
 msgid ""
 "2. If the shell is in the allowed_shells list but not in <quote>/etc/shells</"
 "quote>, use the value of the shell_fallback parameter."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1129
+#: sssd.conf.5.xml:1102
 msgid ""
 "3. If the shell is not in the allowed_shells list and not in <quote>/etc/"
 "shells</quote>, a nologin shell is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1134
+#: sssd.conf.5.xml:1107
 msgid "The wildcard (*) can be used to allow any shell."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1137
+#: sssd.conf.5.xml:1110
 msgid ""
 "The (*) is useful if you want to use shell_fallback in case that user's "
 "shell is not in <quote>/etc/shells</quote> and maintaining list of all "
@@ -1418,113 +1399,113 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1144
+#: sssd.conf.5.xml:1117
 msgid "An empty string for shell is passed as-is to libc."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1147
+#: sssd.conf.5.xml:1120
 msgid ""
 "The <quote>/etc/shells</quote> is only read on SSSD start up, which means "
 "that a restart of the SSSD is required in case a new shell is installed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1151
+#: sssd.conf.5.xml:1124
 msgid "Default: Not set. The user shell is automatically used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1156
+#: sssd.conf.5.xml:1129
 msgid "vetoed_shells (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1159
+#: sssd.conf.5.xml:1132
 msgid "Replace any instance of these shells with the shell_fallback"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1164
+#: sssd.conf.5.xml:1137
 msgid "shell_fallback (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1167
+#: sssd.conf.5.xml:1140
 msgid ""
 "The default shell to use if an allowed shell is not installed on the machine."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1171
+#: sssd.conf.5.xml:1144
 msgid "Default: /bin/sh"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1176
+#: sssd.conf.5.xml:1149
 msgid "default_shell"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1179
+#: sssd.conf.5.xml:1152
 msgid ""
 "The default shell to use if the provider does not return one during lookup. "
 "This option can be specified globally in the [nss] section or per-domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1185
+#: sssd.conf.5.xml:1158
 msgid ""
 "Default: not set (Return NULL if no shell is specified and rely on libc to "
 "substitute something sensible when necessary, usually /bin/sh)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1192 sssd.conf.5.xml:1575
+#: sssd.conf.5.xml:1165 sssd.conf.5.xml:1548
 msgid "get_domains_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1195 sssd.conf.5.xml:1578
+#: sssd.conf.5.xml:1168 sssd.conf.5.xml:1551
 msgid ""
 "Specifies time in seconds for which the list of subdomains will be "
 "considered valid."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1204
+#: sssd.conf.5.xml:1177
 msgid "memcache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1207
+#: sssd.conf.5.xml:1180
 msgid ""
 "Specifies time in seconds for which records in the in-memory cache will be "
 "valid. Setting this option to zero will disable the in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1215
+#: sssd.conf.5.xml:1188
 msgid ""
 "WARNING: Disabling the in-memory cache will have significant negative impact "
 "on SSSD's performance and should only be used for testing."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1221 sssd.conf.5.xml:1246 sssd.conf.5.xml:1271
-#: sssd.conf.5.xml:1296 sssd.conf.5.xml:1323
+#: sssd.conf.5.xml:1194 sssd.conf.5.xml:1219 sssd.conf.5.xml:1244
+#: sssd.conf.5.xml:1269 sssd.conf.5.xml:1296
 msgid ""
 "NOTE: If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", "
 "client applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1229
+#: sssd.conf.5.xml:1202
 msgid "memcache_size_passwd (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1232
+#: sssd.conf.5.xml:1205
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for passwd requests.  Setting the size to 0 will disable the passwd in-"
@@ -1532,25 +1513,25 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1238 sssd.conf.5.xml:2990 sssd-ldap.5.xml:549
+#: sssd.conf.5.xml:1211 sssd.conf.5.xml:2963 sssd-ldap.5.xml:549
 msgid "Default: 8"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1241 sssd.conf.5.xml:1266 sssd.conf.5.xml:1291
-#: sssd.conf.5.xml:1318
+#: sssd.conf.5.xml:1214 sssd.conf.5.xml:1239 sssd.conf.5.xml:1264
+#: sssd.conf.5.xml:1291
 msgid ""
 "WARNING: Disabled or too small in-memory cache can have significant negative "
 "impact on SSSD's performance."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1254
+#: sssd.conf.5.xml:1227
 msgid "memcache_size_group (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1257
+#: sssd.conf.5.xml:1230
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for group requests.  Setting the size to 0 will disable the group in-memory "
@@ -1558,19 +1539,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1263 sssd.conf.5.xml:1315 sssd.conf.5.xml:3751
+#: sssd.conf.5.xml:1236 sssd.conf.5.xml:1288 sssd.conf.5.xml:3724
 #: sssd-ldap.5.xml:474 sssd-ldap.5.xml:526 include/failover.xml:116
 #: include/krb5_options.xml:11
 msgid "Default: 6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1279
+#: sssd.conf.5.xml:1252
 msgid "memcache_size_initgroups (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1282
+#: sssd.conf.5.xml:1255
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for initgroups requests.  Setting the size to 0 will disable the initgroups "
@@ -1578,12 +1559,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1304
+#: sssd.conf.5.xml:1277
 msgid "memcache_size_sid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1307
+#: sssd.conf.5.xml:1280
 msgid ""
 "Size (in megabytes) of the data table allocated inside fast in-memory cache "
 "for SID related requests.  Only SID-by-ID and ID-by-SID requests are "
@@ -1592,12 +1573,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1331 sssd-ifp.5.xml:90
+#: sssd.conf.5.xml:1304 sssd-ifp.5.xml:90
 msgid "user_attributes (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1334
+#: sssd.conf.5.xml:1307
 msgid ""
 "Some of the additional NSS responder requests can return more attributes "
 "than just the POSIX ones defined by the NSS interface. The list of "
@@ -1608,43 +1589,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1347
+#: sssd.conf.5.xml:1320
 msgid ""
 "To make configuration more easy the NSS responder will check the InfoPipe "
 "option if it is not set for the NSS responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1352
+#: sssd.conf.5.xml:1325
 msgid "Default: not set, fallback to InfoPipe option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1357
+#: sssd.conf.5.xml:1330
 msgid "pwfield (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1360
+#: sssd.conf.5.xml:1333
 msgid ""
 "The value that NSS operations that return users or groups will return for "
 "the <quote>password</quote> field."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1365
+#: sssd.conf.5.xml:1338
 msgid "Default: <quote>*</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1368
+#: sssd.conf.5.xml:1341
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[nss] section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1372
+#: sssd.conf.5.xml:1345
 msgid ""
 "Default: <quote>not set</quote> (remote domains), <phrase "
 "condition=\"with_files_provider\"> <quote>x</quote> (the files domain), </"
@@ -1653,60 +1634,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:1384
+#: sssd.conf.5.xml:1357
 msgid "PAM configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:1386
+#: sssd.conf.5.xml:1359
 msgid ""
 "These options can be used to configure the Pluggable Authentication Module "
 "(PAM) service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1391
+#: sssd.conf.5.xml:1364
 msgid "offline_credentials_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1394
+#: sssd.conf.5.xml:1367
 msgid ""
 "If the authentication provider is offline, how long should we allow cached "
 "logins (in days since the last successful online login)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1399 sssd.conf.5.xml:1412
+#: sssd.conf.5.xml:1372 sssd.conf.5.xml:1385
 msgid "Default: 0 (No limit)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1405
+#: sssd.conf.5.xml:1378
 msgid "offline_failed_login_attempts (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1408
+#: sssd.conf.5.xml:1381
 msgid ""
 "If the authentication provider is offline, how many failed login attempts "
 "are allowed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1418
+#: sssd.conf.5.xml:1391
 msgid "offline_failed_login_delay (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1421
+#: sssd.conf.5.xml:1394
 msgid ""
 "The time in minutes which has to pass after offline_failed_login_attempts "
 "has been reached before a new login attempt is possible."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1426
+#: sssd.conf.5.xml:1399
 msgid ""
 "If set to 0 the user cannot authenticate offline if "
 "offline_failed_login_attempts has been reached. Only a successful online "
@@ -1714,59 +1695,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1432 sssd.conf.5.xml:1542
+#: sssd.conf.5.xml:1405 sssd.conf.5.xml:1515
 msgid "Default: 5"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1438
+#: sssd.conf.5.xml:1411
 msgid "pam_verbosity (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1441
+#: sssd.conf.5.xml:1414
 msgid ""
 "Controls what kind of messages are shown to the user during authentication. "
 "The higher the number to more messages are displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1446
+#: sssd.conf.5.xml:1419
 msgid "Currently sssd supports the following values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1449
+#: sssd.conf.5.xml:1422
 msgid "<emphasis>0</emphasis>: do not show any message"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1452
+#: sssd.conf.5.xml:1425
 msgid "<emphasis>1</emphasis>: show only important messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1456
+#: sssd.conf.5.xml:1429
 msgid "<emphasis>2</emphasis>: show informational messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1459
+#: sssd.conf.5.xml:1432
 msgid "<emphasis>3</emphasis>: show all messages and debug information"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1463 sssd.8.xml:63
+#: sssd.conf.5.xml:1436 sssd.8.xml:63
 msgid "Default: 1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1469
+#: sssd.conf.5.xml:1442
 msgid "pam_response_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1472
+#: sssd.conf.5.xml:1445
 msgid ""
 "A comma separated list of strings which allows to remove (filter) data sent "
 "by the PAM responder to pam_sss PAM module. There are different kind of "
@@ -1775,51 +1756,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1480
+#: sssd.conf.5.xml:1453
 msgid ""
 "While messages already can be controlled with the help of the pam_verbosity "
 "option this option allows to filter out other kind of responses as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1487
+#: sssd.conf.5.xml:1460
 msgid "ENV"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1488
+#: sssd.conf.5.xml:1461
 msgid "Do not send any environment variables to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1491
+#: sssd.conf.5.xml:1464
 msgid "ENV:var_name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1492
+#: sssd.conf.5.xml:1465
 msgid "Do not send environment variable var_name to any service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1496
+#: sssd.conf.5.xml:1469
 msgid "ENV:var_name:service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1497
+#: sssd.conf.5.xml:1470
 msgid "Do not send environment variable var_name to service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1485
+#: sssd.conf.5.xml:1458
 msgid ""
 "Currently the following filters are supported: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1504
+#: sssd.conf.5.xml:1477
 msgid ""
 "The list of strings can either be the list of filters which would set this "
 "list of filters and overwrite the defaults. Or each element of the list can "
@@ -1830,23 +1811,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1515
+#: sssd.conf.5.xml:1488
 msgid "Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1518
+#: sssd.conf.5.xml:1491
 msgid ""
 "Example: -ENV:KRB5CCNAME:sudo-i will remove the filter from the default list"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1525
+#: sssd.conf.5.xml:1498
 msgid "pam_id_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1528
+#: sssd.conf.5.xml:1501
 msgid ""
 "For any PAM request while SSSD is online, the SSSD will attempt to "
 "immediately update the cached identity information for the user in order to "
@@ -1854,7 +1835,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1534
+#: sssd.conf.5.xml:1507
 msgid ""
 "A complete PAM conversation may perform multiple PAM requests, such as "
 "account management and session opening. This option controls (on a per-"
@@ -1863,17 +1844,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1548
+#: sssd.conf.5.xml:1521
 msgid "pam_pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1551 sssd.conf.5.xml:3014
+#: sssd.conf.5.xml:1524 sssd.conf.5.xml:2987
 msgid "Display a warning N days before the password expires."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1554
+#: sssd.conf.5.xml:1527
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -1881,31 +1862,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1560 sssd.conf.5.xml:3017
+#: sssd.conf.5.xml:1533 sssd.conf.5.xml:2990
 msgid ""
 "If zero is set, then this filter is not applied, i.e. if the expiration "
 "warning was received from backend server, it will automatically be displayed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1565
+#: sssd.conf.5.xml:1538
 msgid ""
 "This setting can be overridden by setting <emphasis>pwd_expiration_warning</"
 "emphasis> for a particular domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1570 sssd.conf.5.xml:4017 sssd-ldap.5.xml:607 sssd.8.xml:79
+#: sssd.conf.5.xml:1543 sssd.conf.5.xml:3990 sssd-ldap.5.xml:607
+#: sssd-ldap.5.xml:1673 sssd.8.xml:79
 msgid "Default: 0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1587
+#: sssd.conf.5.xml:1560
 msgid "pam_trusted_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1590
+#: sssd.conf.5.xml:1563
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to run PAM conversations against trusted domains.  Users not "
@@ -1915,75 +1897,75 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1600
+#: sssd.conf.5.xml:1573
 msgid "Default: All users are considered trusted by default"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1604
+#: sssd.conf.5.xml:1577
 msgid ""
 "Please note that UID 0 is always allowed to access the PAM responder even in "
 "case it is not in the pam_trusted_users list."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1611
+#: sssd.conf.5.xml:1584
 msgid "pam_public_domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1614
+#: sssd.conf.5.xml:1587
 msgid ""
 "Specifies the comma-separated list of domain names that are accessible even "
 "to untrusted users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1618
+#: sssd.conf.5.xml:1591
 msgid "Two special values for pam_public_domains option are defined:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1622
+#: sssd.conf.5.xml:1595
 msgid ""
 "all (Untrusted users are allowed to access all domains in PAM responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1626
+#: sssd.conf.5.xml:1599
 msgid ""
 "none (Untrusted users are not allowed to access any domains PAM in "
 "responder.)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1630 sssd.conf.5.xml:1655 sssd.conf.5.xml:1674
-#: sssd.conf.5.xml:1911 sssd.conf.5.xml:2752 sssd.conf.5.xml:3946
-#: sssd-ldap.5.xml:1209
+#: sssd.conf.5.xml:1603 sssd.conf.5.xml:1628 sssd.conf.5.xml:1647
+#: sssd.conf.5.xml:1884 sssd.conf.5.xml:2725 sssd.conf.5.xml:3919
+#: sssd-ldap.5.xml:1210
 msgid "Default: none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1635
+#: sssd.conf.5.xml:1608
 msgid "pam_account_expired_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1638
+#: sssd.conf.5.xml:1611
 msgid ""
 "Allows a custom expiration message to be set, replacing the default "
 "'Permission denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1643
+#: sssd.conf.5.xml:1616
 msgid ""
 "Note: Please be aware that message is only printed for the SSH service "
 "unless pam_verbosity is set to 3 (show all messages and debug information)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1651
+#: sssd.conf.5.xml:1624
 #, no-wrap
 msgid ""
 "pam_account_expired_message = Account expired, please contact help desk.\n"
@@ -1991,19 +1973,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1660
+#: sssd.conf.5.xml:1633
 msgid "pam_account_locked_message (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1663
+#: sssd.conf.5.xml:1636
 msgid ""
 "Allows a custom lockout message to be set, replacing the default 'Permission "
 "denied' message."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1670
+#: sssd.conf.5.xml:1643
 #, no-wrap
 msgid ""
 "pam_account_locked_message = Account locked, please contact help desk.\n"
@@ -2011,46 +1993,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1679
+#: sssd.conf.5.xml:1652
 msgid "pam_passkey_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1682
+#: sssd.conf.5.xml:1655
 msgid "Enable passkey device based authentication."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1685 sssd.conf.5.xml:1997 sssd-ad.5.xml:1271
+#: sssd.conf.5.xml:1658 sssd.conf.5.xml:1970 sssd-ad.5.xml:1272
 #: sss_rpcidmapd.5.xml:76 sssd-files.5.xml:145
 msgid "Default: True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1690
+#: sssd.conf.5.xml:1663
 msgid "passkey_debug_libfido2 (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1693
+#: sssd.conf.5.xml:1666
 msgid "Enable libfido2 library debug messages."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1696 sssd.conf.5.xml:1710 sssd-ldap.5.xml:672
-#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1295
-#: sssd-ad.5.xml:505 sssd-ad.5.xml:581 sssd-ad.5.xml:1126 sssd-ad.5.xml:1175
+#: sssd.conf.5.xml:1669 sssd.conf.5.xml:1683 sssd-ldap.5.xml:672
+#: sssd-ldap.5.xml:693 sssd-ldap.5.xml:789 sssd-ldap.5.xml:1296
+#: sssd-ad.5.xml:506 sssd-ad.5.xml:582 sssd-ad.5.xml:1127 sssd-ad.5.xml:1176
 #: include/ldap_id_mapping.xml:250
 msgid "Default: False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1701
+#: sssd.conf.5.xml:1674
 msgid "pam_cert_auth (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1704
+#: sssd.conf.5.xml:1677
 msgid ""
 "Enable certificate based Smartcard authentication.  Since this requires "
 "additional communication with the Smartcard which will delay the "
@@ -2058,34 +2040,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1715
+#: sssd.conf.5.xml:1688
 msgid "pam_cert_db_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1718
+#: sssd.conf.5.xml:1691
 msgid "The path to the certificate database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1721 sssd.conf.5.xml:2246 sssd.conf.5.xml:4438
+#: sssd.conf.5.xml:1694 sssd.conf.5.xml:2219 sssd.conf.5.xml:4411
 msgid "Default:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1723 sssd.conf.5.xml:2248
+#: sssd.conf.5.xml:1696 sssd.conf.5.xml:2221
 msgid ""
 "/etc/sssd/pki/sssd_auth_ca_db.pem (path to a file with trusted CA "
 "certificates in PEM format)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1733
+#: sssd.conf.5.xml:1706
 msgid "pam_cert_verification (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1736
+#: sssd.conf.5.xml:1709
 msgid ""
 "With this parameter the PAM certificate verification can be tuned with a "
 "comma separated list of options that override the "
@@ -2095,7 +2077,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1747
+#: sssd.conf.5.xml:1720
 #, no-wrap
 msgid ""
 "pam_cert_verification = partial_chain\n"
@@ -2103,59 +2085,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1751
+#: sssd.conf.5.xml:1724
 msgid ""
 "Default: not set, i.e. use default <quote>certificate_verification</quote> "
 "option defined in <quote>[sssd]</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1758
+#: sssd.conf.5.xml:1731
 msgid "p11_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1761
+#: sssd.conf.5.xml:1734
 msgid "How many seconds will pam_sss wait for p11_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1770
+#: sssd.conf.5.xml:1743
 msgid "passkey_child_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1773
+#: sssd.conf.5.xml:1746
 msgid ""
 "How many seconds will the PAM responder wait for passkey_child to finish."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1782
+#: sssd.conf.5.xml:1755
 msgid "pam_app_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1785
+#: sssd.conf.5.xml:1758
 msgid ""
 "Which PAM services are permitted to contact domains of type "
 "<quote>application</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1794
+#: sssd.conf.5.xml:1767
 msgid "pam_p11_allowed_services (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1797
+#: sssd.conf.5.xml:1770
 msgid ""
 "A comma-separated list of PAM service names for which it will be allowed to "
 "use Smartcards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1812
+#: sssd.conf.5.xml:1785
 #, no-wrap
 msgid ""
 "pam_p11_allowed_services = +my_pam_service, -login\n"
@@ -2163,7 +2145,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1801
+#: sssd.conf.5.xml:1774
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -2175,63 +2157,63 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1816 sssd-ad.5.xml:644 sssd-ad.5.xml:753 sssd-ad.5.xml:811
-#: sssd-ad.5.xml:869 sssd-ad.5.xml:947
+#: sssd.conf.5.xml:1789 sssd-ad.5.xml:645 sssd-ad.5.xml:754 sssd-ad.5.xml:812
+#: sssd-ad.5.xml:870 sssd-ad.5.xml:948
 msgid "Default: the default set of PAM service names includes:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1821 sssd-ad.5.xml:648
+#: sssd.conf.5.xml:1794 sssd-ad.5.xml:649
 msgid "login"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1826 sssd-ad.5.xml:653
+#: sssd.conf.5.xml:1799 sssd-ad.5.xml:654
 msgid "su"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1831 sssd-ad.5.xml:658
+#: sssd.conf.5.xml:1804 sssd-ad.5.xml:659
 msgid "su-l"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1836 sssd-ad.5.xml:673
+#: sssd.conf.5.xml:1809 sssd-ad.5.xml:674
 msgid "gdm-smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1841 sssd-ad.5.xml:668
+#: sssd.conf.5.xml:1814 sssd-ad.5.xml:669
 msgid "gdm-password"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1846 sssd-ad.5.xml:678
+#: sssd.conf.5.xml:1819 sssd-ad.5.xml:679
 msgid "kdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1851 sssd-ad.5.xml:956
+#: sssd.conf.5.xml:1824 sssd-ad.5.xml:957
 msgid "sudo"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1856 sssd-ad.5.xml:961
+#: sssd.conf.5.xml:1829 sssd-ad.5.xml:962
 msgid "sudo-i"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:1861
+#: sssd.conf.5.xml:1834
 msgid "gnome-screensaver"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1869
+#: sssd.conf.5.xml:1842
 msgid "p11_wait_for_card_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1872
+#: sssd.conf.5.xml:1845
 msgid ""
 "If Smartcard authentication is required how many extra seconds in addition "
 "to p11_child_timeout should the PAM responder wait until a Smartcard is "
@@ -2239,12 +2221,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1883
+#: sssd.conf.5.xml:1856
 msgid "p11_uri (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1886
+#: sssd.conf.5.xml:1859
 msgid ""
 "PKCS#11 URI (see RFC-7512 for details) which can be used to restrict the "
 "selection of devices used for Smartcard authentication. By default SSSD's "
@@ -2255,7 +2237,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1899
+#: sssd.conf.5.xml:1872
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader\n"
@@ -2263,7 +2245,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1903
+#: sssd.conf.5.xml:1876
 #, no-wrap
 msgid ""
 "p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2\n"
@@ -2271,7 +2253,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1897
+#: sssd.conf.5.xml:1870
 msgid ""
 "Example: <placeholder type=\"programlisting\" id=\"0\"/> or <placeholder "
 "type=\"programlisting\" id=\"1\"/> To find suitable URI please check the "
@@ -2280,47 +2262,47 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1916
+#: sssd.conf.5.xml:1889
 msgid "pam_initgroups_scheme"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1924
+#: sssd.conf.5.xml:1897
 msgid "always"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1925
+#: sssd.conf.5.xml:1898
 msgid ""
 "Always do an online lookup, please note that pam_id_timeout still applies"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1929
+#: sssd.conf.5.xml:1902
 msgid "no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1930
+#: sssd.conf.5.xml:1903
 msgid ""
 "Only do an online lookup if there is no active session of the user, i.e. if "
 "the user is currently not logged in"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:1935
+#: sssd.conf.5.xml:1908
 msgid "never"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1936
+#: sssd.conf.5.xml:1909
 msgid ""
 "Never force an online lookup, use the data from the cache as long as they "
 "are not expired"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1919
+#: sssd.conf.5.xml:1892
 msgid ""
 "The PAM responder can force an online lookup to get the current group "
 "memberships of the user trying to log in. This option controls when this "
@@ -2329,30 +2311,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1943
+#: sssd.conf.5.xml:1916
 msgid "Default: no_session"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1948 sssd.conf.5.xml:4377
+#: sssd.conf.5.xml:1921 sssd.conf.5.xml:4350
 msgid "pam_gssapi_services"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1951
+#: sssd.conf.5.xml:1924
 msgid ""
 "Comma separated list of PAM services that are allowed to try GSSAPI "
 "authentication using pam_sss_gss.so module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1956
+#: sssd.conf.5.xml:1929
 msgid ""
 "To disable GSSAPI authentication, set this option to <quote>-</quote> (dash)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1960 sssd.conf.5.xml:1991 sssd.conf.5.xml:2029
+#: sssd.conf.5.xml:1933 sssd.conf.5.xml:1964 sssd.conf.5.xml:2002
 msgid ""
 "Note: This option can also be set per-domain which overwrites the value in "
 "[pam] section. It can also be set for trusted domain which overwrites the "
@@ -2360,7 +2342,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:1968
+#: sssd.conf.5.xml:1941
 #, no-wrap
 msgid ""
 "pam_gssapi_services = sudo, sudo-i\n"
@@ -2368,22 +2350,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1966 sssd.conf.5.xml:3940
+#: sssd.conf.5.xml:1939 sssd.conf.5.xml:3913
 msgid "Example: <placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1972
+#: sssd.conf.5.xml:1945
 msgid "Default: - (GSSAPI authentication is disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:1977 sssd.conf.5.xml:4378
+#: sssd.conf.5.xml:1950 sssd.conf.5.xml:4351
 msgid "pam_gssapi_check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1980
+#: sssd.conf.5.xml:1953
 msgid ""
 "If True, SSSD will require that the Kerberos user principal that "
 "successfully authenticated through GSSAPI can be associated with the user "
@@ -2391,19 +2373,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1987
+#: sssd.conf.5.xml:1960
 msgid ""
 "If False, every user that is able to obtained required service ticket will "
 "be authenticated."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2002
+#: sssd.conf.5.xml:1975
 msgid "pam_gssapi_indicators_map"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2005
+#: sssd.conf.5.xml:1978
 msgid ""
 "Comma separated list of authentication indicators required to be present in "
 "a Kerberos ticket to access a PAM service that is allowed to try GSSAPI "
@@ -2411,7 +2393,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2011
+#: sssd.conf.5.xml:1984
 msgid ""
 "Each element of the list can be either an authentication indicator name or a "
 "pair <quote>service:indicator</quote>. Indicators not prefixed with the PAM "
@@ -2426,7 +2408,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2024
+#: sssd.conf.5.xml:1997
 msgid ""
 "To disable GSSAPI authentication indicator check, set this option to <quote>-"
 "</quote> (dash). To disable the check for a specific PAM service, add "
@@ -2434,45 +2416,45 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2035
+#: sssd.conf.5.xml:2008
 msgid ""
 "Following authentication indicators are supported by IPA Kerberos "
 "deployments:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2038
+#: sssd.conf.5.xml:2011
 msgid ""
 "pkinit -- pre-authentication using X.509 certificates -- whether stored in "
 "files or on smart cards."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2041
+#: sssd.conf.5.xml:2014
 msgid ""
 "hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a "
 "FAST channel."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2044
+#: sssd.conf.5.xml:2017
 msgid "radius -- pre-authentication with the help of a RADIUS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2047
+#: sssd.conf.5.xml:2020
 msgid ""
 "otp -- pre-authentication using integrated two-factor authentication (2FA or "
 "one-time password, OTP) in IPA."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2050
+#: sssd.conf.5.xml:2023
 msgid "idp -- pre-authentication using external identity provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:2060
+#: sssd.conf.5.xml:2033
 #, no-wrap
 msgid ""
 "pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit\n"
@@ -2480,7 +2462,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2055
+#: sssd.conf.5.xml:2028
 msgid ""
 "Example: to require access to SUDO services only for users which obtained "
 "their Kerberos tickets with a X.509 certificate pre-authentication (PKINIT), "
@@ -2488,17 +2470,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2064
+#: sssd.conf.5.xml:2037
 msgid "Default: not set (use of authentication indicators is not required)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2072
+#: sssd.conf.5.xml:2045
 msgid "SUDO configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2074
+#: sssd.conf.5.xml:2047
 msgid ""
 "These options can be used to configure the sudo service.  The detailed "
 "instructions for configuration of <citerefentry> <refentrytitle>sudo</"
@@ -2509,24 +2491,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2091
+#: sssd.conf.5.xml:2064
 msgid "sudo_timed (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2094
+#: sssd.conf.5.xml:2067
 msgid ""
 "Whether or not to evaluate the sudoNotBefore and sudoNotAfter attributes "
 "that implement time-dependent sudoers entries."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2106
+#: sssd.conf.5.xml:2079
 msgid "sudo_threshold (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2109
+#: sssd.conf.5.xml:2082
 msgid ""
 "Maximum number of expired rules that can be refreshed at once. If number of "
 "expired rules is below threshold, those rules are refreshed with "
@@ -2536,22 +2518,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2128
+#: sssd.conf.5.xml:2101
 msgid "AUTOFS configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2130
+#: sssd.conf.5.xml:2103
 msgid "These options can be used to configure the autofs service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2134
+#: sssd.conf.5.xml:2107
 msgid "autofs_negative_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2137
+#: sssd.conf.5.xml:2110
 msgid ""
 "Specifies for how many seconds should the autofs responder negative cache "
 "hits (that is, queries for invalid map entries, like nonexistent ones) "
@@ -2559,51 +2541,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2153
+#: sssd.conf.5.xml:2126
 msgid "SSH configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2155
+#: sssd.conf.5.xml:2128
 msgid "These options can be used to configure the SSH service."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2159
+#: sssd.conf.5.xml:2132
 msgid "ssh_hash_known_hosts (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2162
+#: sssd.conf.5.xml:2135
 msgid ""
 "Whether or not to hash host names and addresses in the managed known_hosts "
 "file."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2171
+#: sssd.conf.5.xml:2144
 msgid "ssh_known_hosts_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2174
+#: sssd.conf.5.xml:2147
 msgid ""
 "How many seconds to keep a host in the managed known_hosts file after its "
 "host keys were requested."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2178
+#: sssd.conf.5.xml:2151
 msgid "Default: 180"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2183
+#: sssd.conf.5.xml:2156
 msgid "ssh_use_certificate_keys (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2186
+#: sssd.conf.5.xml:2159
 msgid ""
 "If set to true the <command>sss_ssh_authorizedkeys</command> will return ssh "
 "keys derived from the public key of X.509 certificates stored in the user "
@@ -2612,12 +2594,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2201
+#: sssd.conf.5.xml:2174
 msgid "ssh_use_certificate_matching_rules (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2204
+#: sssd.conf.5.xml:2177
 msgid ""
 "By default the ssh responder will use all available certificate matching "
 "rules to filter the certificates so that ssh keys are only derived from the "
@@ -2627,7 +2609,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2213
+#: sssd.conf.5.xml:2186
 msgid ""
 "There are two special key words 'all_rules' and 'no_rules' which will enable "
 "all or no rules, respectively. The latter means that no certificates will be "
@@ -2635,7 +2617,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2220
+#: sssd.conf.5.xml:2193
 msgid ""
 "If no rules are configured using 'all_rules' will enable a default rule "
 "which enables all certificates suitable for client authentication.  This is "
@@ -2644,38 +2626,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2227
+#: sssd.conf.5.xml:2200
 msgid ""
 "A non-existing rule name is considered an error.  If as a result no rule is "
 "selected all certificates will be ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2232
+#: sssd.conf.5.xml:2205
 msgid ""
 "Default: not set, equivalent to 'all_rules', all found rules or the default "
 "rule are used"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2238
+#: sssd.conf.5.xml:2211
 msgid "ca_db (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2241
+#: sssd.conf.5.xml:2214
 msgid ""
 "Path to a storage of trusted CA certificates. The option is used to validate "
 "user certificates before deriving public ssh keys from them."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2261
+#: sssd.conf.5.xml:2234
 msgid "PAC responder configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2263
+#: sssd.conf.5.xml:2236
 msgid ""
 "The PAC responder works together with the authorization data plugin for MIT "
 "Kerberos sssd_pac_plugin.so and a sub-domain provider. The plugin sends the "
@@ -2686,7 +2668,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2272
+#: sssd.conf.5.xml:2245
 msgid ""
 "If the remote user does not exist in the cache, it is created. The UID is "
 "determined with the help of the SID, trusted domains will have UPGs and the "
@@ -2697,24 +2679,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:2280
+#: sssd.conf.5.xml:2253
 msgid ""
 "If there are SIDs of groups from domains sssd knows about, the user will be "
 "added to those groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2286
+#: sssd.conf.5.xml:2259
 msgid "These options can be used to configure the PAC responder."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2290 sssd-ifp.5.xml:66
+#: sssd.conf.5.xml:2263 sssd-ifp.5.xml:66
 msgid "allowed_uids (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2293
+#: sssd.conf.5.xml:2266
 msgid ""
 "Specifies the comma-separated list of UID values or user names that are "
 "allowed to access the PAC responder. User names are resolved to UIDs at "
@@ -2722,19 +2704,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2299
+#: sssd.conf.5.xml:2272
 msgid ""
 "Default: 0, &sssd_user_name; (only root and SSSD service users are allowed "
 "to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2303
+#: sssd.conf.5.xml:2276
 msgid "Default: 0 (only the root user is allowed to access the PAC responder)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2307
+#: sssd.conf.5.xml:2280
 msgid ""
 "Please note that defaults will be overwritten with this option. If you still "
 "want to allow the root and/or '&sssd_user_name;' user to access the PAC "
@@ -2743,7 +2725,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2314
+#: sssd.conf.5.xml:2287
 msgid ""
 "Please note that although the UID 0 is used as the default it will be "
 "overwritten with this option. If you still want to allow the root user to "
@@ -2752,24 +2734,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2323
+#: sssd.conf.5.xml:2296
 msgid "pac_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2326
+#: sssd.conf.5.xml:2299
 msgid ""
 "Lifetime of the PAC entry in seconds. As long as the PAC is valid the PAC "
 "data can be used to determine the group memberships of a user."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2336
+#: sssd.conf.5.xml:2309
 msgid "pac_check (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2339
+#: sssd.conf.5.xml:2312
 msgid ""
 "Apply additional checks on the PAC of the Kerberos ticket which is available "
 "in Active Directory and FreeIPA domains, if configured. Please note that "
@@ -2780,24 +2762,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2353
+#: sssd.conf.5.xml:2326
 msgid "no_check"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2355
+#: sssd.conf.5.xml:2328
 msgid ""
 "The PAC must not be present and even if it is present no additional checks "
 "will be done."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2361
+#: sssd.conf.5.xml:2334
 msgid "pac_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2363
+#: sssd.conf.5.xml:2336
 msgid ""
 "The PAC must be present in the service ticket which SSSD will request with "
 "the help of the user's TGT. If the PAC is not available the authentication "
@@ -2805,24 +2787,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2371
+#: sssd.conf.5.xml:2344
 msgid "check_upn"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2373
+#: sssd.conf.5.xml:2346
 msgid ""
 "If the PAC is present check if the user principal name (UPN) information is "
 "consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2379
+#: sssd.conf.5.xml:2352
 msgid "check_upn_allow_missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2381
+#: sssd.conf.5.xml:2354
 msgid ""
 "This option should be used together with 'check_upn' and handles the case "
 "where a UPN is set on the server-side but is not read by SSSD. The typical "
@@ -2834,7 +2816,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2393
+#: sssd.conf.5.xml:2366
 msgid ""
 "Currently this option is set by default to avoid regressions in such "
 "environments. A log message will be added to the system log and SSSD's debug "
@@ -2845,60 +2827,60 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2407
+#: sssd.conf.5.xml:2380
 msgid "upn_dns_info_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2409
+#: sssd.conf.5.xml:2382
 msgid "The PAC must contain the UPN-DNS-INFO buffer, implies 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2414
+#: sssd.conf.5.xml:2387
 msgid "check_upn_dns_info_ex"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2416
+#: sssd.conf.5.xml:2389
 msgid ""
 "If the PAC is present and the extension to the UPN-DNS-INFO buffer is "
 "available check if the information in the extension is consistent."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2423
+#: sssd.conf.5.xml:2396
 msgid "upn_dns_info_ex_present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2425
+#: sssd.conf.5.xml:2398
 msgid ""
 "The PAC must contain the extension of the UPN-DNS-INFO buffer, implies "
 "'check_upn_dns_info_ex', 'upn_dns_info_present' and 'check_upn'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2349
+#: sssd.conf.5.xml:2322
 msgid ""
 "The following options can be used alone or in a comma-separated list: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2435
+#: sssd.conf.5.xml:2408
 msgid ""
 "Default: no_check (AD and IPA provider 'check_upn, check_upn_allow_missing, "
 "check_upn_dns_info_ex')"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:2444
+#: sssd.conf.5.xml:2417
 msgid "Session recording configuration options"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2446
+#: sssd.conf.5.xml:2419
 msgid ""
 "Session recording works in conjunction with <citerefentry> "
 "<refentrytitle>tlog-rec-session</refentrytitle> <manvolnum>8</manvolnum> </"
@@ -2908,66 +2890,66 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:2459
+#: sssd.conf.5.xml:2432
 msgid "These options can be used to configure session recording."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:64
+#: sssd.conf.5.xml:2436 sssd-session-recording.5.xml:64
 msgid "scope (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2470 sssd-session-recording.5.xml:71
+#: sssd.conf.5.xml:2443 sssd-session-recording.5.xml:71
 msgid "\"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:74
+#: sssd.conf.5.xml:2446 sssd-session-recording.5.xml:74
 msgid "No users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:79
+#: sssd.conf.5.xml:2451 sssd-session-recording.5.xml:79
 msgid "\"some\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:82
+#: sssd.conf.5.xml:2454 sssd-session-recording.5.xml:82
 msgid ""
 "Users/groups specified by <replaceable>users</replaceable> and "
 "<replaceable>groups</replaceable> options are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2490 sssd-session-recording.5.xml:91
+#: sssd.conf.5.xml:2463 sssd-session-recording.5.xml:91
 msgid "\"all\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2493 sssd-session-recording.5.xml:94
+#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:94
 msgid "All users are recorded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2466 sssd-session-recording.5.xml:67
+#: sssd.conf.5.xml:2439 sssd-session-recording.5.xml:67
 msgid ""
 "One of the following strings specifying the scope of session recording: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2500 sssd-session-recording.5.xml:101
+#: sssd.conf.5.xml:2473 sssd-session-recording.5.xml:101
 msgid "Default: \"none\""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2505 sssd-session-recording.5.xml:106
+#: sssd.conf.5.xml:2478 sssd-session-recording.5.xml:106
 msgid "users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:109
+#: sssd.conf.5.xml:2481 sssd-session-recording.5.xml:109
 msgid ""
 "A comma-separated list of users which should have session recording enabled. "
 "Matches user names as returned by NSS. I.e. after the possible space "
@@ -2975,17 +2957,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2514 sssd-session-recording.5.xml:115
+#: sssd.conf.5.xml:2487 sssd-session-recording.5.xml:115
 msgid "Default: Empty. Matches no users."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2519 sssd-session-recording.5.xml:120
+#: sssd.conf.5.xml:2492 sssd-session-recording.5.xml:120
 msgid "groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2522 sssd-session-recording.5.xml:123
+#: sssd.conf.5.xml:2495 sssd-session-recording.5.xml:123
 msgid ""
 "A comma-separated list of groups, members of which should have session "
 "recording enabled. Matches group names as returned by NSS. I.e. after the "
@@ -2993,7 +2975,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2528 sssd.conf.5.xml:2560 sssd-session-recording.5.xml:129
+#: sssd.conf.5.xml:2501 sssd.conf.5.xml:2533 sssd-session-recording.5.xml:129
 #: sssd-session-recording.5.xml:161
 msgid ""
 "NOTE: using this option (having it set to anything) has a considerable "
@@ -3002,57 +2984,57 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2535 sssd-session-recording.5.xml:136
+#: sssd.conf.5.xml:2508 sssd-session-recording.5.xml:136
 msgid "Default: Empty. Matches no groups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:141
+#: sssd.conf.5.xml:2513 sssd-session-recording.5.xml:141
 msgid "exclude_users (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2543 sssd-session-recording.5.xml:144
+#: sssd.conf.5.xml:2516 sssd-session-recording.5.xml:144
 msgid ""
 "A comma-separated list of users to be excluded from recording, only "
 "applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2547 sssd-session-recording.5.xml:148
+#: sssd.conf.5.xml:2520 sssd-session-recording.5.xml:148
 msgid "Default: Empty. No users excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2552 sssd-session-recording.5.xml:153
+#: sssd.conf.5.xml:2525 sssd-session-recording.5.xml:153
 msgid "exclude_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2555 sssd-session-recording.5.xml:156
+#: sssd.conf.5.xml:2528 sssd-session-recording.5.xml:156
 msgid ""
 "A comma-separated list of groups, members of which should be excluded from "
 "recording. Only applicable with 'scope=all'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2567 sssd-session-recording.5.xml:168
+#: sssd.conf.5.xml:2540 sssd-session-recording.5.xml:168
 msgid "Default: Empty. No groups excluded."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:2577
+#: sssd.conf.5.xml:2550
 msgid "DOMAIN SECTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:2584 sssd.conf.5.xml:4068 sssd.conf.5.xml:4069
-#: sssd.conf.5.xml:4072
+#: sssd.conf.5.xml:2557 sssd.conf.5.xml:4041 sssd.conf.5.xml:4042
+#: sssd.conf.5.xml:4045
 msgid "enabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2587
+#: sssd.conf.5.xml:2560
 msgid ""
 "Explicitly enable or disable the domain. If <quote>true</quote>, the domain "
 "is always <quote>enabled</quote>. If <quote>false</quote>, the domain is "
@@ -3062,12 +3044,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2599
+#: sssd.conf.5.xml:2572
 msgid "domain_type (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2602
+#: sssd.conf.5.xml:2575
 msgid ""
 "Specifies whether the domain is meant to be used by POSIX-aware clients such "
 "as the Name Service Switch or by applications that do not need POSIX data to "
@@ -3076,14 +3058,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2610
+#: sssd.conf.5.xml:2583
 msgid ""
 "Allowed values for this option are <quote>posix</quote> and "
 "<quote>application</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2614
+#: sssd.conf.5.xml:2587
 msgid ""
 "POSIX domains are reachable by all services. Application domains are only "
 "reachable from the InfoPipe responder (see <citerefentry> "
@@ -3092,38 +3074,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2622
+#: sssd.conf.5.xml:2595
 msgid ""
 "NOTE: The application domains are currently well tested with "
 "<quote>id_provider=ldap</quote> only."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2626
+#: sssd.conf.5.xml:2599
 msgid ""
 "For an easy way to configure a non-POSIX domains, please see the "
 "<quote>Application domains</quote> section."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2630
+#: sssd.conf.5.xml:2603
 msgid "Default: posix"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2636
+#: sssd.conf.5.xml:2609
 msgid "min_id,max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2639
+#: sssd.conf.5.xml:2612
 msgid ""
 "UID and GID limits for the domain. If a domain contains an entry that is "
 "outside these limits, it is ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2644
+#: sssd.conf.5.xml:2617
 msgid ""
 "For users, this affects the primary GID limit. The user will not be returned "
 "to NSS if either the UID or the primary GID is outside the range. For non-"
@@ -3132,24 +3114,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2651
+#: sssd.conf.5.xml:2624
 msgid ""
 "These ID limits affect even saving entries to cache, not only returning them "
 "by name or ID."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2655
+#: sssd.conf.5.xml:2628
 msgid "Default: 1 for min_id, 0 (no limit) for max_id"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2661
+#: sssd.conf.5.xml:2634
 msgid "enumerate (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2664
+#: sssd.conf.5.xml:2637
 msgid ""
 "Determines if a domain can be enumerated, that is, whether the domain can "
 "list all the users and group it contains. Note that it is not required to "
@@ -3158,36 +3140,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2672
+#: sssd.conf.5.xml:2645
 msgid "TRUE = Users and groups are enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2675
+#: sssd.conf.5.xml:2648
 msgid "FALSE = No enumerations for this domain"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2678 sssd.conf.5.xml:2969 sssd.conf.5.xml:3146
+#: sssd.conf.5.xml:2651 sssd.conf.5.xml:2942 sssd.conf.5.xml:3119
 msgid "Default: FALSE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2681
+#: sssd.conf.5.xml:2654
 msgid ""
 "Enumerating a domain requires SSSD to download and store ALL user and group "
 "entries from the remote server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2686
+#: sssd.conf.5.xml:2659
 msgid ""
 "Feature is only supported for domains with id_provider = ldap or id_provider "
 "= proxy."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2690
+#: sssd.conf.5.xml:2663
 msgid ""
 "Note: Enabling enumeration has a severe performance impact on SSSD while "
 "enumeration is running. It may take up to several minutes after SSSD startup "
@@ -3201,14 +3183,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2705
+#: sssd.conf.5.xml:2678
 msgid ""
 "While the first enumeration is running, requests for the complete user or "
 "group lists may return no results until it completes."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2710
+#: sssd.conf.5.xml:2683
 msgid ""
 "Further, enabling enumeration may increase the time necessary to detect "
 "network disconnection, as longer timeouts are required to ensure that "
@@ -3217,14 +3199,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2718
+#: sssd.conf.5.xml:2691
 msgid ""
 "For the reasons cited above, enabling enumeration is not recommended, "
 "especially in large environments."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2723
+#: sssd.conf.5.xml:2696
 msgid ""
 "Note: the proxy provider is tested with open source modules like "
 "'libnss_files' and 'libnss_ldap'.  3rd party modules must follow the "
@@ -3232,32 +3214,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2732
+#: sssd.conf.5.xml:2705
 msgid "subdomain_enumerate (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2739
+#: sssd.conf.5.xml:2712
 msgid "all"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2740
+#: sssd.conf.5.xml:2713
 msgid "All discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2743
+#: sssd.conf.5.xml:2716
 msgid "none"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2744
+#: sssd.conf.5.xml:2717
 msgid "No discovered trusted domains will be enumerated"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2735
+#: sssd.conf.5.xml:2708
 msgid ""
 "Whether any of autodetected trusted domains should be enumerated. The "
 "supported values are: <placeholder type=\"variablelist\" id=\"0\"/> "
@@ -3266,19 +3248,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2758
+#: sssd.conf.5.xml:2731
 msgid "entry_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2761
+#: sssd.conf.5.xml:2734
 msgid ""
 "How many seconds should nss_sss consider entries valid before asking the "
 "backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2765
+#: sssd.conf.5.xml:2738
 msgid ""
 "The cache expiration timestamps are stored as attributes of individual "
 "objects in the cache. Therefore, changing the cache timeout only has effect "
@@ -3289,139 +3271,139 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2778
+#: sssd.conf.5.xml:2751
 msgid "Default: 5400"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2784
+#: sssd.conf.5.xml:2757
 msgid "entry_cache_user_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2787
+#: sssd.conf.5.xml:2760
 msgid ""
 "How many seconds should nss_sss consider user entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2791 sssd.conf.5.xml:2804 sssd.conf.5.xml:2817
-#: sssd.conf.5.xml:2830 sssd.conf.5.xml:2844 sssd.conf.5.xml:2857
-#: sssd.conf.5.xml:2871 sssd.conf.5.xml:2885 sssd.conf.5.xml:2898
+#: sssd.conf.5.xml:2764 sssd.conf.5.xml:2777 sssd.conf.5.xml:2790
+#: sssd.conf.5.xml:2803 sssd.conf.5.xml:2817 sssd.conf.5.xml:2830
+#: sssd.conf.5.xml:2844 sssd.conf.5.xml:2858 sssd.conf.5.xml:2871
 msgid "Default: entry_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2797
+#: sssd.conf.5.xml:2770
 msgid "entry_cache_group_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2800
+#: sssd.conf.5.xml:2773
 msgid ""
 "How many seconds should nss_sss consider group entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2810
+#: sssd.conf.5.xml:2783
 msgid "entry_cache_netgroup_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2813
+#: sssd.conf.5.xml:2786
 msgid ""
 "How many seconds should nss_sss consider netgroup entries valid before "
 "asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2823
+#: sssd.conf.5.xml:2796
 msgid "entry_cache_service_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2826
+#: sssd.conf.5.xml:2799
 msgid ""
 "How many seconds should nss_sss consider service entries valid before asking "
 "the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2836
+#: sssd.conf.5.xml:2809
 msgid "entry_cache_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2839
+#: sssd.conf.5.xml:2812
 msgid ""
 "How many seconds should nss_sss consider hosts and networks entries valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2850
+#: sssd.conf.5.xml:2823
 msgid "entry_cache_sudo_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2853
+#: sssd.conf.5.xml:2826
 msgid ""
 "How many seconds should sudo consider rules valid before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2863
+#: sssd.conf.5.xml:2836
 msgid "entry_cache_autofs_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2866
+#: sssd.conf.5.xml:2839
 msgid ""
 "How many seconds should the autofs service consider automounter maps valid "
 "before asking the backend again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2877
+#: sssd.conf.5.xml:2850
 msgid "entry_cache_ssh_host_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2880
+#: sssd.conf.5.xml:2853
 msgid ""
 "How many seconds to keep a host ssh key after refresh. IE how long to cache "
 "the host key for."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2891
+#: sssd.conf.5.xml:2864
 msgid "entry_cache_computer_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2894
+#: sssd.conf.5.xml:2867
 msgid ""
 "How many seconds to keep the local computer entry before asking the backend "
 "again"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2904
+#: sssd.conf.5.xml:2877
 msgid "refresh_expired_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2907
+#: sssd.conf.5.xml:2880
 msgid ""
 "Specifies how many seconds SSSD has to wait before triggering a background "
 "refresh task which will refresh all expired or nearly expired records."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2912
+#: sssd.conf.5.xml:2885
 msgid ""
 "The background refresh will process users, groups and netgroups in the "
 "cache. For users who have performed the initgroups (get group membership for "
@@ -3430,17 +3412,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2920
+#: sssd.conf.5.xml:2893
 msgid "This option is automatically inherited for all trusted domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2924
+#: sssd.conf.5.xml:2897
 msgid "You can consider setting this value to 3/4 * entry_cache_timeout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2928
+#: sssd.conf.5.xml:2901
 msgid ""
 "Cache entry will be refreshed by background task when 2/3 of cache timeout "
 "has already passed.  If there are existing cached entries, the background "
@@ -3452,18 +3434,18 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2941 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1753
+#: sssd.conf.5.xml:2914 sssd-ldap.5.xml:361 sssd-ldap.5.xml:1774
 #: sssd-ipa.5.xml:270
 msgid "Default: 0 (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2947
+#: sssd.conf.5.xml:2920
 msgid "cache_credentials (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2950
+#: sssd.conf.5.xml:2923
 msgid ""
 "Determines if user credentials are also cached in the local LDB cache. The "
 "cached credentials refer to passwords, which includes the first (long term) "
@@ -3474,7 +3456,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2961
+#: sssd.conf.5.xml:2934
 msgid ""
 "Take a note that while credentials are stored as a salted SHA512 hash, this "
 "still potentially poses some security risk in case an attacker manages to "
@@ -3483,12 +3465,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2975
+#: sssd.conf.5.xml:2948
 msgid "cache_credentials_minimal_first_factor_length (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2978
+#: sssd.conf.5.xml:2951
 msgid ""
 "If 2-Factor-Authentication (2FA) is used and credentials should be saved "
 "this value determines the minimal length the first authentication factor "
@@ -3496,19 +3478,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2985
+#: sssd.conf.5.xml:2958
 msgid ""
 "This should avoid that the short PINs of a PIN based 2FA scheme are saved in "
 "the cache which would make them easy targets for brute-force attacks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:2996
+#: sssd.conf.5.xml:2969
 msgid "account_cache_expiration (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:2999
+#: sssd.conf.5.xml:2972
 msgid ""
 "Number of days entries are left in cache after last successful login before "
 "being removed during a cleanup of the cache. 0 means keep forever.  The "
@@ -3517,17 +3499,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3006
+#: sssd.conf.5.xml:2979
 msgid "Default: 0 (unlimited)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3011
+#: sssd.conf.5.xml:2984
 msgid "pwd_expiration_warning (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3022
+#: sssd.conf.5.xml:2995
 msgid ""
 "Please note that the backend server has to provide information about the "
 "expiration time of the password.  If this information is missing, sssd "
@@ -3536,28 +3518,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3029
+#: sssd.conf.5.xml:3002
 msgid "Default: 7 (Kerberos), 0 (LDAP)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3035
+#: sssd.conf.5.xml:3008
 msgid "id_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3038
+#: sssd.conf.5.xml:3011
 msgid ""
 "The identification provider used for the domain.  Supported ID providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3042
+#: sssd.conf.5.xml:3015
 msgid "<quote>proxy</quote>: Support a legacy NSS provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3045
+#: sssd.conf.5.xml:3018
 msgid ""
 "<quote>files</quote>: FILES provider. See <citerefentry> <refentrytitle>sssd-"
 "files</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3565,7 +3547,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3053
+#: sssd.conf.5.xml:3026
 msgid ""
 "<quote>ldap</quote>: LDAP provider. See <citerefentry> <refentrytitle>sssd-"
 "ldap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for more "
@@ -3573,8 +3555,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3061 sssd.conf.5.xml:3172 sssd.conf.5.xml:3223
-#: sssd.conf.5.xml:3286
+#: sssd.conf.5.xml:3034 sssd.conf.5.xml:3145 sssd.conf.5.xml:3196
+#: sssd.conf.5.xml:3259
 msgid ""
 "<quote>ipa</quote>: FreeIPA and Red Hat Identity Management provider. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3582,8 +3564,8 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3070 sssd.conf.5.xml:3181 sssd.conf.5.xml:3232
-#: sssd.conf.5.xml:3295
+#: sssd.conf.5.xml:3043 sssd.conf.5.xml:3154 sssd.conf.5.xml:3205
+#: sssd.conf.5.xml:3268
 msgid ""
 "<quote>ad</quote>: Active Directory provider. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3591,19 +3573,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3081
+#: sssd.conf.5.xml:3054
 msgid "use_fully_qualified_names (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3084
+#: sssd.conf.5.xml:3057
 msgid ""
 "Use the full name and domain (as formatted by the domain's full_name_format) "
 "as the user's login name reported to NSS."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3089
+#: sssd.conf.5.xml:3062
 msgid ""
 "If set to TRUE, all requests to this domain must use fully qualified names. "
 "For example, if used in LOCAL domain that contains a \"test\" user, "
@@ -3612,7 +3594,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3097
+#: sssd.conf.5.xml:3070
 msgid ""
 "NOTE: This option has no effect on netgroup lookups due to their tendency to "
 "include nested netgroups without qualified names. For netgroups, all domains "
@@ -3620,24 +3602,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3104
+#: sssd.conf.5.xml:3077
 msgid ""
 "Default: FALSE (TRUE for trusted domain/sub-domains or if "
 "default_domain_suffix is used)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3111
+#: sssd.conf.5.xml:3084
 msgid "ignore_group_members (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3114
+#: sssd.conf.5.xml:3087
 msgid "Do not return group members for group lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3117
+#: sssd.conf.5.xml:3090
 msgid ""
 "If set to TRUE, the group membership attribute is not requested from the "
 "ldap server, and group members are not returned when processing group lookup "
@@ -3649,7 +3631,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3135
+#: sssd.conf.5.xml:3108
 msgid ""
 "Enabling this option can also make access provider checks for group "
 "membership significantly faster, especially for groups containing many "
@@ -3657,30 +3639,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3141 sssd.conf.5.xml:3862 sssd-ldap.5.xml:327
+#: sssd.conf.5.xml:3114 sssd.conf.5.xml:3835 sssd-ldap.5.xml:327
 #: sssd-ldap.5.xml:356 sssd-ldap.5.xml:409 sssd-ldap.5.xml:469
 #: sssd-ldap.5.xml:490 sssd-ldap.5.xml:521 sssd-ldap.5.xml:544
 #: sssd-ldap.5.xml:583 sssd-ldap.5.xml:602 sssd-ldap.5.xml:626
-#: sssd-ldap.5.xml:1053 sssd-ldap.5.xml:1086
+#: sssd-ldap.5.xml:1054 sssd-ldap.5.xml:1087
 msgid ""
 "This option can be also set per subdomain or inherited via "
 "<emphasis>subdomain_inherit</emphasis>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3151
+#: sssd.conf.5.xml:3124
 msgid "auth_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3154
+#: sssd.conf.5.xml:3127
 msgid ""
 "The authentication provider used for the domain.  Supported auth providers "
 "are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3158 sssd.conf.5.xml:3216
+#: sssd.conf.5.xml:3131 sssd.conf.5.xml:3189
 msgid ""
 "<quote>ldap</quote> for native LDAP authentication. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3688,7 +3670,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3165
+#: sssd.conf.5.xml:3138
 msgid ""
 "<quote>krb5</quote> for Kerberos authentication. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3696,30 +3678,30 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3189
+#: sssd.conf.5.xml:3162
 msgid ""
 "<quote>proxy</quote> for relaying authentication to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3192
+#: sssd.conf.5.xml:3165
 msgid "<quote>none</quote> disables authentication explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3195
+#: sssd.conf.5.xml:3168
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "authentication requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3201
+#: sssd.conf.5.xml:3174
 msgid "access_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3204
+#: sssd.conf.5.xml:3177
 msgid ""
 "The access control provider used for the domain.  There are two built-in "
 "access providers (in addition to any included in installed backends)  "
@@ -3727,19 +3709,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3210
+#: sssd.conf.5.xml:3183
 msgid ""
 "<quote>permit</quote> always allow access. It's the only permitted access "
 "provider for a local domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3213
+#: sssd.conf.5.xml:3186
 msgid "<quote>deny</quote> always deny access."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3240
+#: sssd.conf.5.xml:3213
 msgid ""
 "<quote>simple</quote> access control based on access or deny lists. See "
 "<citerefentry> <refentrytitle>sssd-simple</refentrytitle> <manvolnum>5</"
@@ -3748,7 +3730,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3247
+#: sssd.conf.5.xml:3220
 msgid ""
 "<quote>krb5</quote>: .k5login based access control.  See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum></"
@@ -3756,29 +3738,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3254
+#: sssd.conf.5.xml:3227
 msgid "<quote>proxy</quote> for relaying access control to another PAM module."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3257
+#: sssd.conf.5.xml:3230
 msgid "Default: <quote>permit</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3262
+#: sssd.conf.5.xml:3235
 msgid "chpass_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3265
+#: sssd.conf.5.xml:3238
 msgid ""
 "The provider which should handle change password operations for the domain.  "
 "Supported change password providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3270
+#: sssd.conf.5.xml:3243
 msgid ""
 "<quote>ldap</quote> to change a password stored in a LDAP server. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -3786,7 +3768,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3278
+#: sssd.conf.5.xml:3251
 msgid ""
 "<quote>krb5</quote> to change the Kerberos password. See <citerefentry> "
 "<refentrytitle>sssd-krb5</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3794,35 +3776,35 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3303
+#: sssd.conf.5.xml:3276
 msgid ""
 "<quote>proxy</quote> for relaying password changes to some other PAM target."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3307
+#: sssd.conf.5.xml:3280
 msgid "<quote>none</quote> disallows password changes explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3310
+#: sssd.conf.5.xml:3283
 msgid ""
 "Default: <quote>auth_provider</quote> is used if it is set and can handle "
 "change password requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3317
+#: sssd.conf.5.xml:3290
 msgid "sudo_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3320
+#: sssd.conf.5.xml:3293
 msgid "The SUDO provider used for the domain.  Supported SUDO providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3324
+#: sssd.conf.5.xml:3297
 msgid ""
 "<quote>ldap</quote> for rules stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3830,32 +3812,32 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3332
+#: sssd.conf.5.xml:3305
 msgid ""
 "<quote>ipa</quote> the same as <quote>ldap</quote> but with IPA default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3336
+#: sssd.conf.5.xml:3309
 msgid ""
 "<quote>ad</quote> the same as <quote>ldap</quote> but with AD default "
 "settings."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3340
+#: sssd.conf.5.xml:3313
 msgid "<quote>none</quote> disables SUDO explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3343 sssd.conf.5.xml:3429 sssd.conf.5.xml:3494
-#: sssd.conf.5.xml:3519 sssd.conf.5.xml:3555
+#: sssd.conf.5.xml:3316 sssd.conf.5.xml:3402 sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3492 sssd.conf.5.xml:3528
 msgid "Default: The value of <quote>id_provider</quote> is used if it is set."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3347
+#: sssd.conf.5.xml:3320
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -3866,7 +3848,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3362
+#: sssd.conf.5.xml:3335
 msgid ""
 "<emphasis>NOTE:</emphasis> Sudo rules are periodically downloaded in the "
 "background unless the sudo provider is explicitly disabled. Set "
@@ -3875,12 +3857,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3372
+#: sssd.conf.5.xml:3345
 msgid "selinux_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3375
+#: sssd.conf.5.xml:3348
 msgid ""
 "The provider which should handle loading of selinux settings. Note that this "
 "provider will be called right after access provider ends.  Supported selinux "
@@ -3888,7 +3870,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3381
+#: sssd.conf.5.xml:3354
 msgid ""
 "<quote>ipa</quote> to load selinux settings from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3896,31 +3878,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3389
+#: sssd.conf.5.xml:3362
 msgid "<quote>none</quote> disallows fetching selinux settings explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3392
+#: sssd.conf.5.xml:3365
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can handle "
 "selinux loading requests."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3398
+#: sssd.conf.5.xml:3371
 msgid "subdomains_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3401
+#: sssd.conf.5.xml:3374
 msgid ""
 "The provider which should handle fetching of subdomains. This value should "
 "be always the same as id_provider.  Supported subdomain providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3407
+#: sssd.conf.5.xml:3380
 msgid ""
 "<quote>ipa</quote> to load a list of subdomains from an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -3928,7 +3910,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3416
+#: sssd.conf.5.xml:3389
 msgid ""
 "<quote>ad</quote> to load a list of subdomains from an Active Directory "
 "server. See <citerefentry> <refentrytitle>sssd-ad</refentrytitle> "
@@ -3937,17 +3919,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3425
+#: sssd.conf.5.xml:3398
 msgid "<quote>none</quote> disallows fetching subdomains explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3435
+#: sssd.conf.5.xml:3408
 msgid "session_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3438
+#: sssd.conf.5.xml:3411
 msgid ""
 "The provider which configures and manages user session related tasks. The "
 "only user session task currently provided is the integration with Fleet "
@@ -3955,36 +3937,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3445
+#: sssd.conf.5.xml:3418
 msgid "<quote>ipa</quote> to allow performing user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3449
+#: sssd.conf.5.xml:3422
 msgid ""
 "<quote>none</quote> does not perform any kind of user session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3453
+#: sssd.conf.5.xml:3426
 msgid ""
 "Default: <quote>id_provider</quote> is used if it is set and can perform "
 "session related tasks."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3460
+#: sssd.conf.5.xml:3433
 msgid "autofs_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3463
+#: sssd.conf.5.xml:3436
 msgid ""
 "The autofs provider used for the domain.  Supported autofs providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3467
+#: sssd.conf.5.xml:3440
 msgid ""
 "<quote>ldap</quote> to load maps stored in LDAP. See <citerefentry> "
 "<refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -3992,7 +3974,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3474
+#: sssd.conf.5.xml:3447
 msgid ""
 "<quote>ipa</quote> to load maps stored in an IPA server. See <citerefentry> "
 "<refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4000,7 +3982,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3482
+#: sssd.conf.5.xml:3455
 msgid ""
 "<quote>ad</quote> to load maps stored in an AD server. See <citerefentry> "
 "<refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</manvolnum> </"
@@ -4008,24 +3990,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3491
+#: sssd.conf.5.xml:3464
 msgid "<quote>none</quote> disables autofs explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3501
+#: sssd.conf.5.xml:3474
 msgid "hostid_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3504
+#: sssd.conf.5.xml:3477
 msgid ""
 "The provider used for retrieving host identity information.  Supported "
 "hostid providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3508
+#: sssd.conf.5.xml:3481
 msgid ""
 "<quote>ipa</quote> to load host identity stored in an IPA server. See "
 "<citerefentry> <refentrytitle>sssd-ipa</refentrytitle> <manvolnum>5</"
@@ -4033,31 +4015,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3516
+#: sssd.conf.5.xml:3489
 msgid "<quote>none</quote> disables hostid explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3526
+#: sssd.conf.5.xml:3499
 msgid "resolver_provider (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3529
+#: sssd.conf.5.xml:3502
 msgid ""
 "The provider which should handle hosts and networks lookups. Supported "
 "resolver providers are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3533
+#: sssd.conf.5.xml:3506
 msgid ""
 "<quote>proxy</quote> to forward lookups to another NSS library. See "
 "<quote>proxy_resolver_lib_name</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3537
+#: sssd.conf.5.xml:3510
 msgid ""
 "<quote>ldap</quote> to fetch hosts and networks stored in LDAP. See "
 "<citerefentry> <refentrytitle>sssd-ldap</refentrytitle> <manvolnum>5</"
@@ -4065,7 +4047,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3544
+#: sssd.conf.5.xml:3517
 msgid ""
 "<quote>ad</quote> to fetch hosts and networks stored in AD. See "
 "<citerefentry> <refentrytitle>sssd-ad</refentrytitle> <manvolnum>5</"
@@ -4074,12 +4056,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3552
+#: sssd.conf.5.xml:3525
 msgid "<quote>none</quote> disallows fetching hosts and networks explicitly."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3565
+#: sssd.conf.5.xml:3538
 msgid ""
 "Regular expression for this domain that describes how to parse the string "
 "containing user name and domain into these components.  The \"domain\" can "
@@ -4089,24 +4071,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3574
+#: sssd.conf.5.xml:3547
 msgid ""
 "Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;"
 "[^@]+))$</quote> which allows two different styles for user names:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3579 sssd.conf.5.xml:3593
+#: sssd.conf.5.xml:3552 sssd.conf.5.xml:3566
 msgid "username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3582 sssd.conf.5.xml:3596
+#: sssd.conf.5.xml:3555 sssd.conf.5.xml:3569
 msgid "username@domain.name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3587
+#: sssd.conf.5.xml:3560
 msgid ""
 "Default for the AD and IPA provider: <quote>^(((?P&lt;domain&gt;[^\\\\]+)\\"
 "\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;"
@@ -4115,19 +4097,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:3599
+#: sssd.conf.5.xml:3572
 msgid "domain\\username"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3602
+#: sssd.conf.5.xml:3575
 msgid ""
 "While the first two correspond to the general default the third one is "
 "introduced to allow easy integration of users from Windows domains."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3607
+#: sssd.conf.5.xml:3580
 msgid ""
 "The default re_expression uses the <quote>@</quote> character as a separator "
 "between the name and the domain. As a result of this setting the default "
@@ -4137,102 +4119,107 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3659
+#: sssd.conf.5.xml:3632
 msgid "Default: <quote>%1$s@%2$s</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3665
+#: sssd.conf.5.xml:3638
 msgid "lookup_family_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3668
+#: sssd.conf.5.xml:3641
 msgid ""
 "Provides the ability to select preferred address family to use when "
 "performing DNS lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3672
+#: sssd.conf.5.xml:3645
 msgid "Supported values:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3675
+#: sssd.conf.5.xml:3648
 msgid "ipv4_first: Try looking up IPv4 address, if that fails, try IPv6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3678
+#: sssd.conf.5.xml:3651
 msgid "ipv4_only: Only attempt to resolve hostnames to IPv4 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3681
+#: sssd.conf.5.xml:3654
 msgid "ipv6_first: Try looking up IPv6 address, if that fails, try IPv4"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3684
+#: sssd.conf.5.xml:3657
 msgid "ipv6_only: Only attempt to resolve hostnames to IPv6 addresses."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3687
+#: sssd.conf.5.xml:3660
 msgid "Default: ipv4_first"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3693
+#: sssd.conf.5.xml:3666
 msgid "dns_resolver_server_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3696
+#: sssd.conf.5.xml:3669
 msgid ""
 "Defines the amount of time (in milliseconds)  SSSD would try to talk to DNS "
 "server before trying next DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3701
+#: sssd.conf.5.xml:3674
 msgid ""
 "The AD provider will use this option for the CLDAP ping timeouts as well."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3705 sssd.conf.5.xml:3725 sssd.conf.5.xml:3746
+#: sssd.conf.5.xml:3678 sssd.conf.5.xml:3698 sssd.conf.5.xml:3719
 msgid ""
 "Please see the section <quote>FAILOVER</quote> for more information about "
 "the service resolution."
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3710 sssd-ldap.5.xml:645 include/failover.xml:84
+#: sssd.conf.5.xml:3683 sssd-ldap.5.xml:645 include/failover.xml:84
 msgid "Default: 1000"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3716
+#: sssd.conf.5.xml:3689
 msgid "dns_resolver_op_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3719
+#: sssd.conf.5.xml:3692
 msgid ""
 "Defines the amount of time (in seconds) to wait to resolve single DNS query "
 "(e.g. resolution of a hostname or an SRV record)  before trying the next "
 "hostname or DNS discovery."
 msgstr ""
 
+#. type: Content of: <refsect1><refsect2><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:3703 include/failover.xml:100
+msgid "Default: 3"
+msgstr "默认： 3"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3736
+#: sssd.conf.5.xml:3709
 msgid "dns_resolver_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3739
+#: sssd.conf.5.xml:3712
 msgid ""
 "Defines the amount of time (in seconds) to wait for a reply from the "
 "internal fail over service before assuming that the service is unreachable. "
@@ -4241,12 +4228,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3757
+#: sssd.conf.5.xml:3730
 msgid "dns_resolver_use_search_list (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3760
+#: sssd.conf.5.xml:3733
 msgid ""
 "Normally, the DNS resolver searches the domain list defined in the "
 "\"search\" directive from the resolv.conf file. This can lead to delays in "
@@ -4254,7 +4241,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3766
+#: sssd.conf.5.xml:3739
 msgid ""
 "If fully qualified domain names (or _srv_) are used in the SSSD "
 "configuration, setting this option to FALSE can prevent unnecessary DNS "
@@ -4262,36 +4249,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3772
+#: sssd.conf.5.xml:3745
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: TRUE"
 msgstr "默认： 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3778
+#: sssd.conf.5.xml:3751
 msgid "dns_discovery_domain (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3781
+#: sssd.conf.5.xml:3754
 msgid ""
 "If service discovery is used in the back end, specifies the domain part of "
 "the service discovery DNS query."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3785
+#: sssd.conf.5.xml:3758
 msgid "Default: Use the domain part of machine's hostname"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3791
+#: sssd.conf.5.xml:3764
 msgid "failover_primary_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3794
+#: sssd.conf.5.xml:3767
 msgid ""
 "When no primary server is available, SSSD fails over to a backup server. "
 "This option defines the number of seconds SSSD waits before attempting to "
@@ -4299,59 +4286,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3801
+#: sssd.conf.5.xml:3774
 msgid "Note: The minimum value is 31."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3804
+#: sssd.conf.5.xml:3777
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: 31"
 msgstr "默认： 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3810
+#: sssd.conf.5.xml:3783
 msgid "override_gid (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3813
+#: sssd.conf.5.xml:3786
 msgid "Override the primary GID value with the one specified."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3819
+#: sssd.conf.5.xml:3792
 msgid "case_sensitive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3826
+#: sssd.conf.5.xml:3799
 msgid "True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3829
+#: sssd.conf.5.xml:3802
 msgid "Case sensitive. This value is invalid for AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3835
+#: sssd.conf.5.xml:3808
 msgid "False"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3837
+#: sssd.conf.5.xml:3810
 msgid "Case insensitive."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3841
+#: sssd.conf.5.xml:3814
 msgid "Preserving"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3844
+#: sssd.conf.5.xml:3817
 msgid ""
 "Same as False (case insensitive), but does not lowercase names in the result "
 "of NSS operations. Note that name aliases (and in case of services also "
@@ -4359,31 +4346,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3852
+#: sssd.conf.5.xml:3825
 msgid ""
 "If you want to set this value for trusted domain with IPA provider, you need "
 "to set it on both the client and SSSD on the server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3822
+#: sssd.conf.5.xml:3795
 msgid ""
 "Treat user and group names as case sensitive.  Possible option values are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3867
+#: sssd.conf.5.xml:3840
 msgid "Default: True (False for AD provider)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3873
+#: sssd.conf.5.xml:3846
 msgid "subdomain_inherit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3876
+#: sssd.conf.5.xml:3849
 msgid ""
 "Specifies a list of configuration parameters that should be inherited by a "
 "subdomain. Please note that only selected parameters can be inherited.  "
@@ -4391,104 +4378,104 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3882
+#: sssd.conf.5.xml:3855
 msgid "ldap_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3885
+#: sssd.conf.5.xml:3858
 msgid "ldap_network_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3888
+#: sssd.conf.5.xml:3861
 msgid "ldap_opt_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3891
+#: sssd.conf.5.xml:3864
 msgid "ldap_offline_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3894
+#: sssd.conf.5.xml:3867
 msgid "ldap_enumeration_refresh_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3897
+#: sssd.conf.5.xml:3870
 msgid "ldap_enumeration_refresh_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3900
+#: sssd.conf.5.xml:3873
 msgid "ldap_purge_cache_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3903
+#: sssd.conf.5.xml:3876
 msgid "ldap_purge_cache_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3906
+#: sssd.conf.5.xml:3879
 msgid ""
 "ldap_krb5_keytab (the value of krb5_keytab will be used if ldap_krb5_keytab "
 "is not set explicitly)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3910
+#: sssd.conf.5.xml:3883
 msgid "ldap_krb5_ticket_lifetime"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3913
+#: sssd.conf.5.xml:3886
 msgid "ldap_enumeration_search_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3916
+#: sssd.conf.5.xml:3889
 msgid "ldap_connection_expire_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3919
+#: sssd.conf.5.xml:3892
 msgid "ldap_connection_expire_offset"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3922
+#: sssd.conf.5.xml:3895
 msgid "ldap_connection_idle_timeout"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3925 sssd-ldap.5.xml:401
+#: sssd.conf.5.xml:3898 sssd-ldap.5.xml:401
 msgid "ldap_use_tokengroups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3928
+#: sssd.conf.5.xml:3901
 msgid "ldap_user_principal"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3931
+#: sssd.conf.5.xml:3904
 msgid "ignore_group_members"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3934
+#: sssd.conf.5.xml:3907
 msgid "auto_private_groups"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3937
+#: sssd.conf.5.xml:3910
 msgid "case_sensitive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:3942
+#: sssd.conf.5.xml:3915
 #, no-wrap
 msgid ""
 "subdomain_inherit = ldap_purge_cache_timeout\n"
@@ -4496,27 +4483,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3949
+#: sssd.conf.5.xml:3922
 msgid "Note: This option only works with the IPA and AD provider."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3956
+#: sssd.conf.5.xml:3929
 msgid "subdomain_homedir (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3967
+#: sssd.conf.5.xml:3940
 msgid "%F"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3968
+#: sssd.conf.5.xml:3941
 msgid "flat (NetBIOS) name of a subdomain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3959
+#: sssd.conf.5.xml:3932
 msgid ""
 "Use this homedir as default value for all subdomains within this domain in "
 "IPA AD trust.  See <emphasis>override_homedir</emphasis> for info about "
@@ -4526,34 +4513,34 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3973
+#: sssd.conf.5.xml:3946
 msgid ""
 "The value can be overridden by <emphasis>override_homedir</emphasis> option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3977
+#: sssd.conf.5.xml:3950
 msgid "Default: <filename>/home/%d/%u</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3982
+#: sssd.conf.5.xml:3955
 msgid "realmd_tags (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3985
+#: sssd.conf.5.xml:3958
 msgid ""
 "Various tags stored by the realmd configuration service for this domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:3991
+#: sssd.conf.5.xml:3964
 msgid "cached_auth_timeout (int)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:3994
+#: sssd.conf.5.xml:3967
 msgid ""
 "Specifies time in seconds since last successful online authentication for "
 "which user will be authenticated using cached credentials while SSSD is in "
@@ -4562,19 +4549,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4002
+#: sssd.conf.5.xml:3975
 msgid ""
 "This option's value is inherited by all trusted domains. At the moment it is "
 "not possible to set a different value per trusted domain."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4007
+#: sssd.conf.5.xml:3980
 msgid "Special value 0 implies that this feature is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4011
+#: sssd.conf.5.xml:3984
 msgid ""
 "Please note that if <quote>cached_auth_timeout</quote> is longer than "
 "<quote>pam_id_timeout</quote> then the back end could be called to handle "
@@ -4582,12 +4569,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4022
+#: sssd.conf.5.xml:3995
 msgid "local_auth_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4025
+#: sssd.conf.5.xml:3998
 msgid ""
 "Local authentication methods policy. Some backends (i.e. LDAP, proxy "
 "provider) only support a password based authentication, while others can "
@@ -4599,7 +4586,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4037
+#: sssd.conf.5.xml:4010
 msgid ""
 "There are three possible values for this option: match, only, enable. "
 "<quote>match</quote> is used to match offline and online states for Kerberos "
@@ -4611,7 +4598,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4050
+#: sssd.conf.5.xml:4023
 msgid ""
 "The following table shows which authentication methods, if configured "
 "properly, are currently enabled or disabled for each backend, with the "
@@ -4619,42 +4606,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4063
+#: sssd.conf.5.xml:4036
 msgid "local_auth_policy = match (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4064
+#: sssd.conf.5.xml:4037
 msgid "Passkey"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd.conf.5.xml:4065
+#: sssd.conf.5.xml:4038
 msgid "Smartcard"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4068 sssd-ldap.5.xml:189
+#: sssd.conf.5.xml:4041 sssd-ldap.5.xml:189
 msgid "IPA"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4071 sssd-ldap.5.xml:194
+#: sssd.conf.5.xml:4044 sssd-ldap.5.xml:194
 msgid "AD"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd.conf.5.xml:4071 sssd.conf.5.xml:4074 sssd.conf.5.xml:4075
+#: sssd.conf.5.xml:4044 sssd.conf.5.xml:4047 sssd.conf.5.xml:4048
 msgid "disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd.conf.5.xml:4074
+#: sssd.conf.5.xml:4047
 msgid "LDAP"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4079
+#: sssd.conf.5.xml:4052
 msgid ""
 "Please note that if local Smartcard authentication is enabled and a "
 "Smartcard is present, Smartcard authentication will be preferred over the "
@@ -4663,7 +4650,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4091
+#: sssd.conf.5.xml:4064
 #, no-wrap
 msgid ""
 "[domain/shadowutils]\n"
@@ -4674,7 +4661,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4087
+#: sssd.conf.5.xml:4060
 msgid ""
 "The following configuration example allows local users to authenticate "
 "locally using any enabled method (i.e. smartcard, passkey).  <placeholder "
@@ -4682,38 +4669,38 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4099
+#: sssd.conf.5.xml:4072
 msgid ""
 "It is expected that the <quote>files</quote> provider ignores the "
 "local_auth_policy option and supports Smartcard authentication by default."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4104
+#: sssd.conf.5.xml:4077
 #, fuzzy
 #| msgid "Default: 3"
 msgid "Default: match"
 msgstr "默认： 3"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4109
+#: sssd.conf.5.xml:4082
 msgid "auto_private_groups (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4115
+#: sssd.conf.5.xml:4088
 msgid "true"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4118
+#: sssd.conf.5.xml:4091
 msgid ""
 "Create user's private group unconditionally from user's UID number.  The GID "
 "number is ignored in this case."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4122
+#: sssd.conf.5.xml:4095
 msgid ""
 "NOTE: Because the GID number and the user private group are inferred from "
 "the UID number, it is not supported to have multiple entries with the same "
@@ -4722,24 +4709,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4131
+#: sssd.conf.5.xml:4104
 msgid "false"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4134
+#: sssd.conf.5.xml:4107
 msgid ""
 "Always use the user's primary GID number. The GID number must refer to a "
 "group object in the LDAP database."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4140
+#: sssd.conf.5.xml:4113
 msgid "hybrid"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4143
+#: sssd.conf.5.xml:4116
 msgid ""
 "A primary group is autogenerated for user entries whose UID and GID numbers "
 "have the same value and at the same time the GID number does not correspond "
@@ -4749,14 +4736,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4156
+#: sssd.conf.5.xml:4129
 msgid ""
 "If the UID and GID of a user are different, then the GID must correspond to "
 "a group entry, otherwise the GID is simply not resolvable."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4163
+#: sssd.conf.5.xml:4136
 msgid ""
 "This feature is useful for environments that wish to stop maintaining a "
 "separate group objects for the user private groups, but also wish to retain "
@@ -4764,21 +4751,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4112
+#: sssd.conf.5.xml:4085
 msgid ""
 "This option takes any of three available values: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4175
+#: sssd.conf.5.xml:4148
 msgid ""
 "For subdomains, the default value is False for subdomains that use assigned "
 "POSIX IDs and True for subdomains that use automatic ID-mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4183
+#: sssd.conf.5.xml:4156
 #, no-wrap
 msgid ""
 "[domain/forest.domain/sub.domain]\n"
@@ -4786,7 +4773,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd.conf.5.xml:4189
+#: sssd.conf.5.xml:4162
 #, no-wrap
 msgid ""
 "[domain/forest.domain]\n"
@@ -4795,7 +4782,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4180
+#: sssd.conf.5.xml:4153
 msgid ""
 "The value of auto_private_groups can either be set per subdomains in a "
 "subsection, for example: <placeholder type=\"programlisting\" id=\"0\"/> or "
@@ -4804,7 +4791,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:2579
+#: sssd.conf.5.xml:2552
 msgid ""
 "These configuration options can be present in a domain configuration "
 "section, that is, in a section called <quote>[domain/<replaceable>NAME</"
@@ -4812,17 +4799,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4204
+#: sssd.conf.5.xml:4177
 msgid "proxy_pam_target (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4207
+#: sssd.conf.5.xml:4180
 msgid "The proxy target PAM proxies to."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4210
+#: sssd.conf.5.xml:4183
 msgid ""
 "Default: not set by default, you have to take an existing pam configuration "
 "or create a new one and add the service name here. As an alternative you can "
@@ -4830,12 +4817,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4220
+#: sssd.conf.5.xml:4193
 msgid "proxy_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4223
+#: sssd.conf.5.xml:4196
 msgid ""
 "The name of the NSS library to use in proxy domains. The NSS functions "
 "searched for in the library are in the form of _nss_$(libName)_$(function), "
@@ -4843,12 +4830,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4233
+#: sssd.conf.5.xml:4206
 msgid "proxy_resolver_lib_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4236
+#: sssd.conf.5.xml:4209
 msgid ""
 "The name of the NSS library to use for hosts and networks lookups in proxy "
 "domains. The NSS functions searched for in the library are in the form of "
@@ -4856,12 +4843,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4247
+#: sssd.conf.5.xml:4220
 msgid "proxy_fast_alias (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4250
+#: sssd.conf.5.xml:4223
 msgid ""
 "When a user or group is looked up by name in the proxy provider, a second "
 "lookup by ID is performed to \"canonicalize\" the name in case the requested "
@@ -4870,12 +4857,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4264
+#: sssd.conf.5.xml:4237
 msgid "proxy_max_children (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4267
+#: sssd.conf.5.xml:4240
 msgid ""
 "This option specifies the number of pre-forked proxy children. It is useful "
 "for high-load SSSD environments where sssd may run out of available child "
@@ -4883,19 +4870,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4200
+#: sssd.conf.5.xml:4173
 msgid ""
 "Options valid for proxy domains.  <placeholder type=\"variablelist\" "
 "id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><title>
-#: sssd.conf.5.xml:4283
+#: sssd.conf.5.xml:4256
 msgid "Application domains"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4285
+#: sssd.conf.5.xml:4258
 msgid ""
 "SSSD, with its D-Bus interface (see <citerefentry> <refentrytitle>sssd-ifp</"
 "refentrytitle> <manvolnum>5</manvolnum> </citerefentry>) is appealing to "
@@ -4912,7 +4899,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4305
+#: sssd.conf.5.xml:4278
 msgid ""
 "Please note that the application domain must still be explicitly enabled in "
 "the <quote>domains</quote> parameter so that the lookup order between the "
@@ -4920,17 +4907,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><title>
-#: sssd.conf.5.xml:4311
+#: sssd.conf.5.xml:4284
 msgid "Application domain parameters"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4313
+#: sssd.conf.5.xml:4286
 msgid "inherit_from (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4316
+#: sssd.conf.5.xml:4289
 msgid ""
 "The SSSD POSIX-type domain the application domain inherits all settings "
 "from. The application domain can moreover add its own settings to the "
@@ -4939,7 +4926,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para>
-#: sssd.conf.5.xml:4330
+#: sssd.conf.5.xml:4303
 msgid ""
 "The following example illustrates the use of an application domain. In this "
 "setup, the POSIX domain is connected to an LDAP server and is used by the OS "
@@ -4949,7 +4936,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><programlisting>
-#: sssd.conf.5.xml:4338
+#: sssd.conf.5.xml:4311
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -4969,12 +4956,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4358
+#: sssd.conf.5.xml:4331
 msgid "TRUSTED DOMAIN SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4360
+#: sssd.conf.5.xml:4333
 msgid ""
 "Some options used in the domain section can also be used in the trusted "
 "domain section, that is, in a section called <quote>[domain/"
@@ -4985,69 +4972,69 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4367
+#: sssd.conf.5.xml:4340
 msgid "ldap_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4368
+#: sssd.conf.5.xml:4341
 msgid "ldap_user_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4369
+#: sssd.conf.5.xml:4342
 msgid "ldap_group_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4370
+#: sssd.conf.5.xml:4343
 msgid "ldap_netgroup_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4371
+#: sssd.conf.5.xml:4344
 msgid "ldap_service_search_base,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4372
+#: sssd.conf.5.xml:4345
 msgid "ldap_sasl_mech,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4373
+#: sssd.conf.5.xml:4346
 msgid "ad_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4374
+#: sssd.conf.5.xml:4347
 msgid "ad_backup_server,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4375
+#: sssd.conf.5.xml:4348
 msgid "ad_site,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><refsect2><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4376 sssd-ipa.5.xml:884
+#: sssd.conf.5.xml:4349 sssd-ipa.5.xml:884
 msgid "use_fully_qualified_names"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4380
+#: sssd.conf.5.xml:4353
 msgid ""
 "For more details about these options see their individual description in the "
 "manual page."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4386
+#: sssd.conf.5.xml:4359
 msgid "CERTIFICATE MAPPING SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4388
+#: sssd.conf.5.xml:4361
 msgid ""
 "To allow authentication with Smartcards and certificates SSSD must be able "
 "to map certificates to users. This can be done by adding the full "
@@ -5060,7 +5047,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4402
+#: sssd.conf.5.xml:4375
 msgid ""
 "To make the mapping more flexible mapping and matching rules were added to "
 "SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> "
@@ -5068,7 +5055,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4411
+#: sssd.conf.5.xml:4384
 msgid ""
 "A mapping and matching rule can be added to the SSSD configuration in a "
 "section on its own with a name like <quote>[certmap/"
@@ -5077,55 +5064,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4418
+#: sssd.conf.5.xml:4391
 msgid "matchrule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4421
+#: sssd.conf.5.xml:4394
 msgid ""
 "Only certificates from the Smartcard which matches this rule will be "
 "processed, all others are ignored."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4425
+#: sssd.conf.5.xml:4398
 msgid ""
 "Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the "
 "Extended Key Usage <quote>clientAuth</quote>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4432
+#: sssd.conf.5.xml:4405
 msgid "maprule (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4435
+#: sssd.conf.5.xml:4408
 msgid "Defines how the user is found for a given certificate."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4441
+#: sssd.conf.5.xml:4414
 msgid ""
 "LDAP:(userCertificate;binary={cert!bin})  for LDAP based providers like "
 "<quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4447
+#: sssd.conf.5.xml:4420
 msgid ""
 "The RULE_NAME for the <quote>files</quote> provider which tries to find a "
 "user with the same name."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4456
+#: sssd.conf.5.xml:4429
 msgid "domains (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4459
+#: sssd.conf.5.xml:4432
 msgid ""
 "Comma separated list of domain names the rule should be applied. By default "
 "a rule is only valid in the domain configured in sssd.conf. If the provider "
@@ -5134,17 +5121,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4466
+#: sssd.conf.5.xml:4439
 msgid "Default: the configured domain in sssd.conf"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4471
+#: sssd.conf.5.xml:4444
 msgid "priority (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4474
+#: sssd.conf.5.xml:4447
 msgid ""
 "Unsigned integer value defining the priority of the rule. The higher the "
 "number the lower the priority.  <quote>0</quote> stands for the highest "
@@ -5152,26 +5139,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4480
+#: sssd.conf.5.xml:4453
 msgid "Default: the lowest priority"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4486
+#: sssd.conf.5.xml:4459
 msgid ""
 "To make the configuration simple and reduce the amount of configuration "
 "options the <quote>files</quote> provider has some special properties:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4492
+#: sssd.conf.5.xml:4465
 msgid ""
 "if maprule is not set the RULE_NAME name is assumed to be the name of the "
 "matching user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4498
+#: sssd.conf.5.xml:4471
 msgid ""
 "if a maprule is used both a single user name or a template like "
 "<quote>{subject_rfc822_name.short_name}</quote> must be in braces like e.g. "
@@ -5180,17 +5167,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4507
+#: sssd.conf.5.xml:4480
 msgid "the <quote>domains</quote> option is ignored"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4515
+#: sssd.conf.5.xml:4488
 msgid "PROMPTING CONFIGURATION SECTION"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4517
+#: sssd.conf.5.xml:4490
 msgid ""
 "If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</"
 "filename>)  exists SSSD's PAM module pam_sss will ask SSSD to figure out "
@@ -5200,7 +5187,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4525
+#: sssd.conf.5.xml:4498
 msgid ""
 "With the growing number of authentication methods and the possibility that "
 "there are multiple ones for a single user the heuristic used by pam_sss to "
@@ -5209,59 +5196,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4537
+#: sssd.conf.5.xml:4510
 msgid "[prompting/password]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4540
+#: sssd.conf.5.xml:4513
 msgid "password_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4541
+#: sssd.conf.5.xml:4514
 msgid "to change the string of the password prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4539
+#: sssd.conf.5.xml:4512
 msgid ""
 "to configure password prompting, allowed options are: <placeholder "
 "type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4549
+#: sssd.conf.5.xml:4522
 msgid "[prompting/2fa]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4553
+#: sssd.conf.5.xml:4526
 msgid "first_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4554
+#: sssd.conf.5.xml:4527
 msgid "to change the string of the prompt for the first factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4557
+#: sssd.conf.5.xml:4530
 msgid "second_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4558
+#: sssd.conf.5.xml:4531
 msgid "to change the string of the prompt for the second factor"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4561
+#: sssd.conf.5.xml:4534
 msgid "single_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4562
+#: sssd.conf.5.xml:4535
 msgid ""
 "boolean value, if True there will be only a single prompt using the value of "
 "first_prompt where it is expected that both factors are entered as a single "
@@ -5270,7 +5257,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4551
+#: sssd.conf.5.xml:4524
 msgid ""
 "to configure two-factor authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/> If the second factor is "
@@ -5278,18 +5265,29 @@ msgid ""
 "or with both factors two-step prompting has to be used."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd.conf.5.xml:4548
+msgid ""
+"Some clients, such as SSH with 'PasswordAuthentication yes', generate their "
+"own prompts and do not use prompts provided by SSSD or other PAM modules. "
+"Additionally, for SSH with PasswordAuthentication, if two-factor "
+"authentication is available, SSSD expects that the credentials entered by "
+"the user at the SSH password prompt will always be the two factors in a "
+"single string, even if two-factor authentication is optional."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4579
+#: sssd.conf.5.xml:4563
 msgid "[prompting/passkey]"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd.conf.5.xml:4585 sssd-ad.5.xml:1021
+#: sssd.conf.5.xml:4569 sssd-ad.5.xml:1022
 msgid "interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4587
+#: sssd.conf.5.xml:4571
 msgid ""
 "boolean value, if True prompt a message and wait before testing the presence "
 "of a passkey device.  Recommended if your device doesn’t have a tactile "
@@ -5297,46 +5295,46 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4595
+#: sssd.conf.5.xml:4579
 msgid "interactive_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4597
+#: sssd.conf.5.xml:4581
 msgid "to change the message of the interactive prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4602
+#: sssd.conf.5.xml:4586
 msgid "touch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4604
+#: sssd.conf.5.xml:4588
 msgid ""
 "boolean value, if True prompt a message to remind the user to touch the "
 "device."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd.conf.5.xml:4610
+#: sssd.conf.5.xml:4594
 msgid "touch_prompt"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4612
+#: sssd.conf.5.xml:4596
 msgid "to change the message of the touch prompt."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:4581
+#: sssd.conf.5.xml:4565
 msgid ""
 "to configure passkey authentication prompting, allowed options are: "
 "<placeholder type=\"variablelist\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4532
+#: sssd.conf.5.xml:4505
 msgid ""
 "Each supported authentication method has its own configuration subsection "
 "under <quote>[prompting/...]</quote>. Currently there are: <placeholder "
@@ -5345,7 +5343,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4623
+#: sssd.conf.5.xml:4607
 msgid ""
 "It is possible to add a subsection for specific PAM services, e.g. "
 "<quote>[prompting/password/sshd]</quote> to individual change the prompting "
@@ -5353,12 +5351,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:4630 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
+#: sssd.conf.5.xml:4614 pam_sss_gss.8.xml:157 idmap_sss.8.xml:43
 msgid "EXAMPLES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4636
+#: sssd.conf.5.xml:4620
 #, no-wrap
 msgid ""
 "[sssd]\n"
@@ -5387,7 +5385,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4632
+#: sssd.conf.5.xml:4616
 msgid ""
 "1. The following example shows a typical SSSD config. It does not describe "
 "configuration of the domains themselves - refer to documentation on "
@@ -5396,7 +5394,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4668
+#: sssd.conf.5.xml:4652
 #, no-wrap
 msgid ""
 "[domain/ipa.com/child.ad.com]\n"
@@ -5404,7 +5402,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4662
+#: sssd.conf.5.xml:4646
 msgid ""
 "2. The following example shows configuration of IPA AD trust where the AD "
 "forest consists of two domains in a parent-child structure.  Suppose IPA "
@@ -5415,7 +5413,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd.conf.5.xml:4679
+#: sssd.conf.5.xml:4663
 #, no-wrap
 msgid ""
 "[certmap/my.domain/rule_name]\n"
@@ -5426,7 +5424,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.conf.5.xml:4673
+#: sssd.conf.5.xml:4657
 msgid ""
 "3. The following example shows the configuration of a certificate mapping "
 "rule. It is valid for the configured domain <quote>my.domain</quote> and "
@@ -5588,7 +5586,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:133 sssd-ad.5.xml:311 sss_override.8.xml:143
+#: sssd-ldap.5.xml:133 sssd-ad.5.xml:312 sss_override.8.xml:143
 #: sss_override.8.xml:240 sssd-ldap-attributes.5.xml:453
 msgid "Examples:"
 msgstr ""
@@ -6000,7 +5998,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1728
+#: sssd-ldap.5.xml:588 sssd-ldap.5.xml:631 sssd-ldap.5.xml:1749
 msgid "Default: 900 (15 minutes)"
 msgstr ""
 
@@ -6253,7 +6251,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:863 sssd-ldap.5.xml:904
+#: sssd-ldap.5.xml:845 sssd-ldap.5.xml:864 sssd-ldap.5.xml:905
 msgid ""
 "Default: use OpenLDAP defaults, typically in <filename>/etc/openldap/ldap."
 "conf</filename>"
@@ -6270,36 +6268,37 @@ msgid ""
 "Specifies the path of a directory that contains Certificate Authority "
 "certificates in separate individual files. Typically the file names need to "
 "be the hash of the certificate followed by '.0'.  If available, "
-"<command>cacertdir_rehash</command> can be used to create the correct names."
+"<command>openssl rehash</command> or <command>c_rehash</command> can be used "
+"to create the correct names."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:870
+#: sssd-ldap.5.xml:871
 msgid "ldap_tls_cert (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:873
+#: sssd-ldap.5.xml:874
 msgid "Specifies the file that contains the certificate for the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:883
+#: sssd-ldap.5.xml:884
 msgid "ldap_tls_key (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:886
+#: sssd-ldap.5.xml:887
 msgid "Specifies the file that contains the client's key."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:895
+#: sssd-ldap.5.xml:896
 msgid "ldap_tls_cipher_suite (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:898
+#: sssd-ldap.5.xml:899
 msgid ""
 "Specifies acceptable cipher suites.  Typically this is a colon separated "
 "list.  See <citerefentry><refentrytitle>ldap.conf</refentrytitle> "
@@ -6307,12 +6306,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:911
+#: sssd-ldap.5.xml:912
 msgid "ldap_id_use_start_tls (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:914
+#: sssd-ldap.5.xml:915
 msgid ""
 "Specifies that the id_provider connection must also use <systemitem "
 "class=\"protocol\">tls</systemitem> to protect the channel.  <emphasis>true</"
@@ -6320,12 +6319,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:925
+#: sssd-ldap.5.xml:926
 msgid "ldap_id_mapping (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:928
+#: sssd-ldap.5.xml:929
 msgid ""
 "Specifies that SSSD should attempt to map user and group IDs from the "
 "ldap_user_objectsid and ldap_group_objectsid attributes instead of relying "
@@ -6333,17 +6332,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:934
+#: sssd-ldap.5.xml:935
 msgid "Currently this feature supports only ActiveDirectory objectSID mapping."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:944
+#: sssd-ldap.5.xml:945
 msgid "ldap_min_id, ldap_max_id (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:947
+#: sssd-ldap.5.xml:948
 msgid ""
 "In contrast to the SID based ID mapping which is used if ldap_id_mapping is "
 "set to true the allowed ID range for ldap_user_uid_number and "
@@ -6354,24 +6353,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:959
+#: sssd-ldap.5.xml:960
 msgid "Default: not set (both options are set to 0)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:965
+#: sssd-ldap.5.xml:966
 msgid "ldap_sasl_mech (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:968
+#: sssd-ldap.5.xml:969
 msgid ""
 "Specify the SASL mechanism to use.  Currently only GSSAPI and GSS-SPNEGO are "
 "tested and supported."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:972
+#: sssd-ldap.5.xml:973
 msgid ""
 "If the backend supports sub-domains the value of ldap_sasl_mech is "
 "automatically inherited to the sub-domains. If a different value is needed "
@@ -6382,12 +6381,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:988
+#: sssd-ldap.5.xml:989
 msgid "ldap_sasl_authid (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ldap.5.xml:1000
+#: sssd-ldap.5.xml:1001
 #, no-wrap
 msgid ""
 "hostname@REALM\n"
@@ -6400,7 +6399,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:991
+#: sssd-ldap.5.xml:992
 msgid ""
 "Specify the SASL authorization id to use.  When GSSAPI/GSS-SPNEGO are used, "
 "this represents the Kerberos principal used for authentication to the "
@@ -6412,17 +6411,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1011
+#: sssd-ldap.5.xml:1012
 msgid "Default: host/hostname@REALM"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1017
+#: sssd-ldap.5.xml:1018
 msgid "ldap_sasl_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1020
+#: sssd-ldap.5.xml:1021
 msgid ""
 "Specify the SASL realm to use. When not specified, this option defaults to "
 "the value of krb5_realm.  If the ldap_sasl_authid contains the realm as "
@@ -6430,49 +6429,49 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1026
+#: sssd-ldap.5.xml:1027
 msgid "Default: the value of krb5_realm."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1032
+#: sssd-ldap.5.xml:1033
 msgid "ldap_sasl_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1035
+#: sssd-ldap.5.xml:1036
 msgid ""
 "If set to true, the LDAP library would perform a reverse lookup to "
 "canonicalize the host name during a SASL bind."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1040
+#: sssd-ldap.5.xml:1041
 msgid "Default: false;"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1046
+#: sssd-ldap.5.xml:1047
 msgid "ldap_krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1049
+#: sssd-ldap.5.xml:1050
 msgid "Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1058 sssd-krb5.5.xml:247
+#: sssd-ldap.5.xml:1059 sssd-krb5.5.xml:247
 msgid "Default: System keytab, normally <filename>/etc/krb5.keytab</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1064
+#: sssd-ldap.5.xml:1065
 msgid "ldap_krb5_init_creds (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1067
+#: sssd-ldap.5.xml:1068
 msgid ""
 "Specifies that the id_provider should init Kerberos credentials (TGT).  This "
 "action is performed only if SASL is used and the mechanism selected is "
@@ -6480,28 +6479,28 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1079
+#: sssd-ldap.5.xml:1080
 msgid "ldap_krb5_ticket_lifetime (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1082
+#: sssd-ldap.5.xml:1083
 msgid ""
 "Specifies the lifetime in seconds of the TGT if GSSAPI or GSS-SPNEGO is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1091 sssd-ad.5.xml:1252
+#: sssd-ldap.5.xml:1092 sssd-ad.5.xml:1253
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1097 sssd-krb5.5.xml:74
+#: sssd-ldap.5.xml:1098 sssd-krb5.5.xml:74
 msgid "krb5_server, krb5_backup_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1100
+#: sssd-ldap.5.xml:1101
 msgid ""
 "Specifies the comma-separated list of IP addresses or hostnames of the "
 "Kerberos servers to which SSSD should connect in the order of preference. "
@@ -6513,7 +6512,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1112 sssd-krb5.5.xml:89
+#: sssd-ldap.5.xml:1113 sssd-krb5.5.xml:89
 msgid ""
 "When using service discovery for KDC or kpasswd servers, SSSD first searches "
 "for DNS entries that specify _udp as the protocol and falls back to _tcp if "
@@ -6521,7 +6520,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1117 sssd-krb5.5.xml:94
+#: sssd-ldap.5.xml:1118 sssd-krb5.5.xml:94
 msgid ""
 "This option was named <quote>krb5_kdcip</quote> in earlier releases of SSSD. "
 "While the legacy name is recognized for the time being, users are advised to "
@@ -6529,39 +6528,39 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1126 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
+#: sssd-ldap.5.xml:1127 sssd-ipa.5.xml:531 sssd-krb5.5.xml:103
 msgid "krb5_realm (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1129
+#: sssd-ldap.5.xml:1130
 msgid "Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1133
+#: sssd-ldap.5.xml:1134
 msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1139 include/krb5_options.xml:154
+#: sssd-ldap.5.xml:1140 include/krb5_options.xml:154
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1142
+#: sssd-ldap.5.xml:1143
 msgid ""
 "Specifies if the host principal should be canonicalized when connecting to "
 "LDAP server. This feature is available with MIT Kerberos >= 1.7"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:336
+#: sssd-ldap.5.xml:1155 sssd-krb5.5.xml:336
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1157 sssd-krb5.5.xml:339
+#: sssd-ldap.5.xml:1158 sssd-krb5.5.xml:339
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -6571,7 +6570,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1168 sssd-krb5.5.xml:350
+#: sssd-ldap.5.xml:1169 sssd-krb5.5.xml:350
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6579,26 +6578,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1182
+#: sssd-ldap.5.xml:1183
 msgid "ldap_pwd_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1185
+#: sssd-ldap.5.xml:1186
 msgid ""
 "Select the policy to evaluate the password expiration on the client side. "
 "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1190
+#: sssd-ldap.5.xml:1191
 msgid ""
 "<emphasis>none</emphasis> - No evaluation on the client side. This option "
 "cannot disable server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1195
+#: sssd-ldap.5.xml:1196
 msgid ""
 "<emphasis>shadow</emphasis> - Use <citerefentry><refentrytitle>shadow</"
 "refentrytitle> <manvolnum>5</manvolnum></citerefentry> style attributes to "
@@ -6607,7 +6606,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1203
+#: sssd-ldap.5.xml:1204
 msgid ""
 "<emphasis>mit_kerberos</emphasis> - Use the attributes used by MIT Kerberos "
 "to determine if the password has expired. Use chpass_provider=krb5 to update "
@@ -6615,31 +6614,31 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1212
+#: sssd-ldap.5.xml:1213
 msgid ""
 "<emphasis>Note</emphasis>: if a password policy is configured on server "
 "side, it always takes precedence over policy set with this option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1220
+#: sssd-ldap.5.xml:1221
 msgid "ldap_referrals (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1223
+#: sssd-ldap.5.xml:1224
 msgid "Specifies whether automatic referral chasing should be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1227
+#: sssd-ldap.5.xml:1228
 msgid ""
 "Please note that sssd only supports referral chasing when it is compiled "
 "with OpenLDAP version 2.4.13 or higher."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1232
+#: sssd-ldap.5.xml:1233
 msgid ""
 "Chasing referrals may incur a performance penalty in environments that use "
 "them heavily, a notable example is Microsoft Active Directory. If your setup "
@@ -6652,51 +6651,51 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1251
+#: sssd-ldap.5.xml:1252
 msgid "ldap_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1254
+#: sssd-ldap.5.xml:1255
 msgid "Specifies the service name to use when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1258
+#: sssd-ldap.5.xml:1259
 msgid "Default: ldap"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1264
+#: sssd-ldap.5.xml:1265
 msgid "ldap_chpass_dns_service_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1267
+#: sssd-ldap.5.xml:1268
 msgid ""
 "Specifies the service name to use to find an LDAP server which allows "
 "password changes when service discovery is enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1272
+#: sssd-ldap.5.xml:1273
 msgid "Default: not set, i.e. service discovery is disabled"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1278
+#: sssd-ldap.5.xml:1279
 msgid "ldap_chpass_update_last_change (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1281
+#: sssd-ldap.5.xml:1282
 msgid ""
 "Specifies whether to update the ldap_user_shadow_last_change attribute with "
 "days since the Epoch after a password change operation."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1287
+#: sssd-ldap.5.xml:1288
 msgid ""
 "It is recommend to set this option explicitly if \"ldap_pwd_policy = "
 "shadow\" is used to let SSSD know if the LDAP server will update "
@@ -6705,12 +6704,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1301
+#: sssd-ldap.5.xml:1302
 msgid "ldap_access_filter (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1304
+#: sssd-ldap.5.xml:1305
 msgid ""
 "If using access_provider = ldap and ldap_access_order = filter (default), "
 "this option is mandatory. It specifies an LDAP search filter criteria that "
@@ -6726,12 +6725,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1324
+#: sssd-ldap.5.xml:1325
 msgid "Example:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ldap.5.xml:1327
+#: sssd-ldap.5.xml:1328
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6740,14 +6739,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1331
+#: sssd-ldap.5.xml:1332
 msgid ""
 "This example means that access to this host is restricted to users whose "
 "employeeType attribute is set to \"admin\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1336
+#: sssd-ldap.5.xml:1337
 msgid ""
 "Offline caching for this feature is limited to determining whether the "
 "user's last online login was granted access permission. If they were granted "
@@ -6756,24 +6755,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1344 sssd-ldap.5.xml:1400
+#: sssd-ldap.5.xml:1345 sssd-ldap.5.xml:1401
 msgid "Default: Empty"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1350
+#: sssd-ldap.5.xml:1351
 msgid "ldap_account_expire_policy (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1353
+#: sssd-ldap.5.xml:1354
 msgid ""
 "With this option a client side evaluation of access control attributes can "
 "be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1357
+#: sssd-ldap.5.xml:1358
 msgid ""
 "Please note that it is always recommended to use server side access control, "
 "i.e. the LDAP server should deny the bind request with a suitable error code "
@@ -6781,19 +6780,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1364
+#: sssd-ldap.5.xml:1365
 msgid "The following values are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1367
+#: sssd-ldap.5.xml:1368
 msgid ""
 "<emphasis>shadow</emphasis>: use the value of ldap_user_shadow_expire to "
 "determine if the account is expired."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1372
+#: sssd-ldap.5.xml:1373
 msgid ""
 "<emphasis>ad</emphasis>: use the value of the 32bit field "
 "ldap_user_ad_user_account_control and allow access if the second bit is not "
@@ -6802,7 +6801,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1379
+#: sssd-ldap.5.xml:1380
 msgid ""
 "<emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>, <emphasis>389ds</"
 "emphasis>: use the value of ldap_ns_account_lock to check if access is "
@@ -6810,7 +6809,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1385
+#: sssd-ldap.5.xml:1386
 msgid ""
 "<emphasis>nds</emphasis>: the values of "
 "ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled and "
@@ -6819,7 +6818,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1393
+#: sssd-ldap.5.xml:1394
 msgid ""
 "Please note that the ldap_access_order configuration option <emphasis>must</"
 "emphasis> include <quote>expire</quote> in order for the "
@@ -6827,22 +6826,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1406
+#: sssd-ldap.5.xml:1407
 msgid "ldap_access_order (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1409 sssd-ipa.5.xml:356
+#: sssd-ldap.5.xml:1410 sssd-ipa.5.xml:356
 msgid "Comma separated list of access control options.  Allowed values are:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1413
+#: sssd-ldap.5.xml:1414
 msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1416
+#: sssd-ldap.5.xml:1417
 msgid ""
 "<emphasis>lockout</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6852,14 +6851,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1426
+#: sssd-ldap.5.xml:1427
 msgid ""
 "<emphasis> Please note that this option is superseded by the <quote>ppolicy</"
 "quote> option and might be removed in a future release.  </emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1433
+#: sssd-ldap.5.xml:1434
 msgid ""
 "<emphasis>ppolicy</emphasis>: use account locking.  If set, this option "
 "denies access in case that ldap attribute 'pwdAccountLockedTime' is present "
@@ -6872,12 +6871,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1450
+#: sssd-ldap.5.xml:1451
 msgid "<emphasis>expire</emphasis>: use ldap_account_expire_policy"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1454 sssd-ipa.5.xml:364
+#: sssd-ldap.5.xml:1455 sssd-ipa.5.xml:364
 msgid ""
 "<emphasis>pwd_expire_policy_reject, pwd_expire_policy_warn, "
 "pwd_expire_policy_renew: </emphasis> These options are useful if users are "
@@ -6887,81 +6886,82 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1464 sssd-ipa.5.xml:374
+#: sssd-ldap.5.xml:1465 sssd-ipa.5.xml:374
 msgid ""
 "The difference between these options is the action taken if user password is "
 "expired:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1469 sssd-ipa.5.xml:379
+#: sssd-ldap.5.xml:1470 sssd-ipa.5.xml:379
 msgid "pwd_expire_policy_reject - user is denied to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1475 sssd-ipa.5.xml:385
+#: sssd-ldap.5.xml:1476 sssd-ipa.5.xml:385
 msgid "pwd_expire_policy_warn - user is still able to log in,"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ldap.5.xml:1481 sssd-ipa.5.xml:391
+#: sssd-ldap.5.xml:1482 sssd-ipa.5.xml:391
 msgid ""
 "pwd_expire_policy_renew - user is prompted to change their password "
 "immediately."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1489
+#: sssd-ldap.5.xml:1490
 msgid ""
 "Please note that 'access_provider = ldap' must be set for this feature to "
-"work. Also 'ldap_pwd_policy' must be set to an appropriate password policy."
+"work. Also 'ldap_pwd_policy' must be set to shadow or mit_kerberos, these "
+"options do not work with server-side password policies."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1494
+#: sssd-ldap.5.xml:1496
 msgid ""
 "<emphasis>authorized_service</emphasis>: use the authorizedService attribute "
 "to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1499
+#: sssd-ldap.5.xml:1501
 msgid "<emphasis>host</emphasis>: use the host attribute to determine access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1503
+#: sssd-ldap.5.xml:1505
 msgid ""
 "<emphasis>rhost</emphasis>: use the rhost attribute to determine whether "
 "remote host can access"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1507
+#: sssd-ldap.5.xml:1509
 msgid ""
 "Please note, rhost field in pam is set by application, it is better to check "
 "what the application sends to pam, before enabling this access control option"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1512
+#: sssd-ldap.5.xml:1514
 msgid "Default: filter"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1515
+#: sssd-ldap.5.xml:1517
 msgid ""
 "Please note that it is a configuration error if a value is used more than "
 "once."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1522
+#: sssd-ldap.5.xml:1524
 msgid "ldap_pwdlockout_dn (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1525
+#: sssd-ldap.5.xml:1527
 msgid ""
 "This option specifies the DN of password policy entry on LDAP server. Please "
 "note that absence of this option in sssd.conf in case of enabled account "
@@ -6970,74 +6970,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1533
+#: sssd-ldap.5.xml:1535
 msgid "Example: cn=ppolicy,ou=policies,dc=example,dc=com"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1536
+#: sssd-ldap.5.xml:1538
 msgid "Default: cn=ppolicy,ou=policies,$ldap_search_base"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1542
+#: sssd-ldap.5.xml:1544
 msgid "ldap_deref (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1545
+#: sssd-ldap.5.xml:1547
 msgid ""
 "Specifies how alias dereferencing is done when performing a search. The "
 "following options are allowed:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1550
+#: sssd-ldap.5.xml:1552
 msgid "<emphasis>never</emphasis>: Aliases are never dereferenced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1554
+#: sssd-ldap.5.xml:1556
 msgid ""
 "<emphasis>searching</emphasis>: Aliases are dereferenced in subordinates of "
 "the base object, but not in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1559
+#: sssd-ldap.5.xml:1561
 msgid ""
 "<emphasis>finding</emphasis>: Aliases are only dereferenced when locating "
 "the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1564
+#: sssd-ldap.5.xml:1566
 msgid ""
 "<emphasis>always</emphasis>: Aliases are dereferenced both in searching and "
 "in locating the base object of the search."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1569
+#: sssd-ldap.5.xml:1571
 msgid ""
 "Default: Empty (this is handled as <emphasis>never</emphasis> by the LDAP "
 "client libraries)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1577
+#: sssd-ldap.5.xml:1579
 msgid "ldap_rfc2307_fallback_to_local_users (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1580
+#: sssd-ldap.5.xml:1582
 msgid ""
 "Allows to retain local users as members of an LDAP group for servers that "
 "use the RFC2307 schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1584
+#: sssd-ldap.5.xml:1586
 msgid ""
 "In some environments where the RFC2307 schema is used, local users are made "
 "members of LDAP groups by adding their names to the memberUid attribute.  "
@@ -7048,7 +7048,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1595
+#: sssd-ldap.5.xml:1597
 msgid ""
 "This option falls back to checking if local users are referenced, and caches "
 "them so that later initgroups() calls will augment the local users with the "
@@ -7056,64 +7056,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1607 sssd-ifp.5.xml:152
+#: sssd-ldap.5.xml:1609 sssd-ifp.5.xml:152
 msgid "wildcard_limit (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1610
+#: sssd-ldap.5.xml:1612
 msgid ""
 "Specifies an upper limit on the number of entries that are downloaded during "
 "a wildcard lookup."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1614
+#: sssd-ldap.5.xml:1616
 msgid "At the moment, only the InfoPipe responder supports wildcard lookups."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1618
+#: sssd-ldap.5.xml:1620
 msgid "Default: 1000 (often the size of one page)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1624
+#: sssd-ldap.5.xml:1626
 msgid "ldap_library_debug_level (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627
+#: sssd-ldap.5.xml:1629
 msgid ""
 "Switches on libldap debugging with the given level.  The libldap debug "
 "messages will be written independent of the general debug_level."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1632
+#: sssd-ldap.5.xml:1634
 msgid ""
 "OpenLDAP uses a bitmap to enable debugging for specific components, -1 will "
 "enable full debug output."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1637
+#: sssd-ldap.5.xml:1639
 msgid "Default: 0 (libldap debugging disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1643
+#: sssd-ldap.5.xml:1645
 msgid "ldap_use_ppolicy (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1646
+#: sssd-ldap.5.xml:1648
 msgid ""
 "Turns on requesting and relying on the server-side password policy controls. "
 "Disabling this allows interacting with services which send back invalid "
 "ppolicy extension."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ldap.5.xml:1660
+msgid "ldap_ppolicy_pwd_change_threshold (integer)"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ldap.5.xml:1663
+msgid ""
+"Forces a password change when server side password policy controls are "
+"enabled and remaining grace logins returned by the server after the "
+"authentication reach or go below the threshold.  Note that the minimum "
+"useful value is 2, as changing the password consumes 2 additional grace "
+"logins, one to verify the current password and a second one to perform the "
+"password change."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
 #: sssd-ldap.5.xml:52
 msgid ""
@@ -7127,12 +7143,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1662
+#: sssd-ldap.5.xml:1683
 msgid "SUDO OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1664
+#: sssd-ldap.5.xml:1685
 msgid ""
 "The detailed instructions for configuration of sudo_provider are in the "
 "manual page <citerefentry> <refentrytitle>sssd-sudo</refentrytitle> "
@@ -7140,43 +7156,43 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1675
+#: sssd-ldap.5.xml:1696
 msgid "ldap_sudo_full_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1678
+#: sssd-ldap.5.xml:1699
 msgid ""
 "How many seconds SSSD will wait between executing a full refresh of sudo "
 "rules (which downloads all rules that are stored on the server)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1683
+#: sssd-ldap.5.xml:1704
 msgid ""
 "The value must be greater than <emphasis>ldap_sudo_smart_refresh_interval </"
 "emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1688
+#: sssd-ldap.5.xml:1709
 msgid ""
 "You can disable full refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1693
+#: sssd-ldap.5.xml:1714
 msgid "Default: 21600 (6 hours)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1699
+#: sssd-ldap.5.xml:1720
 msgid "ldap_sudo_smart_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1702
+#: sssd-ldap.5.xml:1723
 msgid ""
 "How many seconds SSSD has to wait before executing a smart refresh of sudo "
 "rules (which downloads all rules that have USN higher than the highest "
@@ -7184,14 +7200,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1708
+#: sssd-ldap.5.xml:1729
 msgid ""
 "If USN attributes are not supported by the server, the modifyTimestamp "
 "attribute is used instead."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1712
+#: sssd-ldap.5.xml:1733
 msgid ""
 "<emphasis>Note:</emphasis> the highest USN value can be updated by three "
 "tasks: 1) By sudo full and smart refresh (if updated rules are found), 2) by "
@@ -7201,19 +7217,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1723
+#: sssd-ldap.5.xml:1744
 msgid ""
 "You can disable smart refresh by setting this option to 0. However, either "
 "smart or full refresh must be enabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1734
+#: sssd-ldap.5.xml:1755
 msgid "ldap_sudo_random_offset (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1737
+#: sssd-ldap.5.xml:1758
 msgid ""
 "Random offset between 0 and configured value is added to smart and full "
 "refresh periods each time the periodic task is scheduled. The value is in "
@@ -7221,7 +7237,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1743
+#: sssd-ldap.5.xml:1764
 msgid ""
 "Note that this random offset is also applied on the first SSSD start which "
 "delays the first sudo rules refresh. This prolongs the time when the sudo "
@@ -7229,106 +7245,106 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1749
+#: sssd-ldap.5.xml:1770
 msgid "You can disable this offset by setting the value to 0."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1759
+#: sssd-ldap.5.xml:1780
 msgid "ldap_sudo_use_host_filter (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1762
+#: sssd-ldap.5.xml:1783
 msgid ""
 "If true, SSSD will download only rules that are applicable to this machine "
 "(using the IPv4 or IPv6 host/network addresses and hostnames)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1773
+#: sssd-ldap.5.xml:1794
 msgid "ldap_sudo_hostnames (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1776
+#: sssd-ldap.5.xml:1797
 msgid ""
 "Space separated list of hostnames or fully qualified domain names that "
 "should be used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1781
+#: sssd-ldap.5.xml:1802
 msgid ""
 "If this option is empty, SSSD will try to discover the hostname and the "
 "fully qualified domain name automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1786 sssd-ldap.5.xml:1809 sssd-ldap.5.xml:1827
-#: sssd-ldap.5.xml:1845
+#: sssd-ldap.5.xml:1807 sssd-ldap.5.xml:1830 sssd-ldap.5.xml:1848
+#: sssd-ldap.5.xml:1866
 msgid ""
 "If <emphasis>ldap_sudo_use_host_filter</emphasis> is <emphasis>false</"
 "emphasis> then this option has no effect."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1791 sssd-ldap.5.xml:1814
+#: sssd-ldap.5.xml:1812 sssd-ldap.5.xml:1835
 msgid "Default: not specified"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1797
+#: sssd-ldap.5.xml:1818
 msgid "ldap_sudo_ip (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1800
+#: sssd-ldap.5.xml:1821
 msgid ""
 "Space separated list of IPv4 or IPv6 host/network addresses that should be "
 "used to filter the rules."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1805
+#: sssd-ldap.5.xml:1826
 msgid ""
 "If this option is empty, SSSD will try to discover the addresses "
 "automatically."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1820
+#: sssd-ldap.5.xml:1841
 msgid "ldap_sudo_include_netgroups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1823
+#: sssd-ldap.5.xml:1844
 msgid ""
 "If true then SSSD will download every rule that contains a netgroup in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1838
+#: sssd-ldap.5.xml:1859
 msgid "ldap_sudo_include_regexp (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1841
+#: sssd-ldap.5.xml:1862
 msgid ""
 "If true then SSSD will download every rule that contains a wildcard in "
 "sudoHost attribute."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><note><para>
-#: sssd-ldap.5.xml:1851
+#: sssd-ldap.5.xml:1872
 msgid ""
 "Using wildcard is an operation that is very costly to evaluate on the LDAP "
 "server side!"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1863
+#: sssd-ldap.5.xml:1884
 msgid ""
 "This manual page only describes attribute name mapping.  For detailed "
 "explanation of sudo related attribute semantics, see <citerefentry> "
@@ -7337,59 +7353,59 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1873
+#: sssd-ldap.5.xml:1894
 msgid "AUTOFS OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1875
+#: sssd-ldap.5.xml:1896
 msgid ""
 "Some of the defaults for the parameters below are dependent on the LDAP "
 "schema."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1881
+#: sssd-ldap.5.xml:1902
 msgid "ldap_autofs_map_master_name (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1884
+#: sssd-ldap.5.xml:1905
 msgid "The name of the automount master map in LDAP."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1887
+#: sssd-ldap.5.xml:1908
 msgid "Default: auto.master"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1898
+#: sssd-ldap.5.xml:1919
 msgid "ADVANCED OPTIONS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1905
+#: sssd-ldap.5.xml:1926
 msgid "ldap_netgroup_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1910
+#: sssd-ldap.5.xml:1931
 msgid "ldap_user_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1915
+#: sssd-ldap.5.xml:1936
 msgid "ldap_group_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note>
-#: sssd-ldap.5.xml:1920
+#: sssd-ldap.5.xml:1941
 msgid "<note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><note><para>
-#: sssd-ldap.5.xml:1922
+#: sssd-ldap.5.xml:1943
 msgid ""
 "If the option <quote>ldap_use_tokengroups</quote> is enabled, the searches "
 "against Active Directory will not be restricted and return all groups "
@@ -7398,22 +7414,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist>
-#: sssd-ldap.5.xml:1929
+#: sssd-ldap.5.xml:1950
 msgid "</note>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1931
+#: sssd-ldap.5.xml:1952
 msgid "ldap_sudo_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1936
+#: sssd-ldap.5.xml:1957
 msgid "ldap_autofs_search_base (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1900
+#: sssd-ldap.5.xml:1921
 msgid ""
 "These options are supported by LDAP domains, but they should be used with "
 "caution. Please include them in your configuration only if you know what you "
@@ -7422,14 +7438,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1951 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
-#: sssd-ad.5.xml:1391 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
+#: sssd-ldap.5.xml:1972 sssd-simple.5.xml:131 sssd-ipa.5.xml:930
+#: sssd-ad.5.xml:1392 sssd-krb5.5.xml:483 sss_rpcidmapd.5.xml:98
 #: sssd-files.5.xml:155 sssd-session-recording.5.xml:176
 msgid "EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1953
+#: sssd-ldap.5.xml:1974
 msgid ""
 "The following example assumes that SSSD is correctly configured and LDAP is "
 "set to one of the domains in the <replaceable>[domains]</replaceable> "
@@ -7437,7 +7453,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1959
+#: sssd-ldap.5.xml:1980
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7450,27 +7466,27 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:1958 sssd-ldap.5.xml:1976 sssd-simple.5.xml:139
-#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1399 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
+#: sssd-ldap.5.xml:1979 sssd-ldap.5.xml:1997 sssd-simple.5.xml:139
+#: sssd-ipa.5.xml:938 sssd-ad.5.xml:1400 sssd-sudo.5.xml:56 sssd-krb5.5.xml:492
 #: sssd-files.5.xml:162 sssd-files.5.xml:173 sssd-session-recording.5.xml:182
 #: include/ldap_id_mapping.xml:105
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1970
+#: sssd-ldap.5.xml:1991
 msgid "LDAP ACCESS FILTER EXAMPLE"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1972
+#: sssd-ldap.5.xml:1993
 msgid ""
 "The following example assumes that SSSD is correctly configured and to use "
 "the ldap_access_order=lockout."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ldap.5.xml:1977
+#: sssd-ldap.5.xml:1998
 #, no-wrap
 msgid ""
 "[domain/LDAP]\n"
@@ -7486,13 +7502,13 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:1992 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
-#: sssd-ad.5.xml:1414 sssd.8.xml:258 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2013 sssd_krb5_locator_plugin.8.xml:83 sssd-simple.5.xml:148
+#: sssd-ad.5.xml:1415 sssd.8.xml:270 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ldap.5.xml:1994
+#: sssd-ldap.5.xml:2015
 msgid ""
 "The descriptions of some of the configuration options in this manual page "
 "are based on the <citerefentry> <refentrytitle>ldap.conf</refentrytitle> "
@@ -9731,7 +9747,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1181
+#: sssd-ipa.5.xml:129 sssd-ad.5.xml:1182
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -9746,7 +9762,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1195
+#: sssd-ipa.5.xml:141 sssd-ad.5.xml:1196
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -9761,12 +9777,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1206
+#: sssd-ipa.5.xml:158 sssd-ad.5.xml:1207
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1209
+#: sssd-ipa.5.xml:161 sssd-ad.5.xml:1210
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -9787,12 +9803,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1220
+#: sssd-ipa.5.xml:178 sssd-ad.5.xml:1221
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1223
+#: sssd-ipa.5.xml:181 sssd-ad.5.xml:1224
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "or a list of interfaces whose IP addresses should be used for dynamic DNS "
@@ -9816,17 +9832,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1234
+#: sssd-ipa.5.xml:198 sssd-ad.5.xml:1235
 msgid "Example: dyndns_iface = em1, vnet1, vnet2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1290
+#: sssd-ipa.5.xml:204 sssd-ad.5.xml:1291
 msgid "dyndns_auth (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1293
+#: sssd-ipa.5.xml:207 sssd-ad.5.xml:1294
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "updates with the DNS server, insecure updates can be sent by setting this "
@@ -9834,17 +9850,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1299
+#: sssd-ipa.5.xml:213 sssd-ad.5.xml:1300
 msgid "Default: GSS-TSIG"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1305
+#: sssd-ipa.5.xml:219 sssd-ad.5.xml:1306
 msgid "dyndns_auth_ptr (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1308
+#: sssd-ipa.5.xml:222 sssd-ad.5.xml:1309
 msgid ""
 "Whether the nsupdate utility should use GSS-TSIG authentication for secure "
 "PTR updates with the DNS server, insecure updates can be sent by setting "
@@ -9852,7 +9868,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1314
+#: sssd-ipa.5.xml:228 sssd-ad.5.xml:1315
 msgid "Default: Same as dyndns_auth"
 msgstr ""
 
@@ -9879,7 +9895,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1240
+#: sssd-ipa.5.xml:260 sssd-ad.5.xml:1241
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
@@ -9892,12 +9908,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1258
+#: sssd-ipa.5.xml:276 sssd-ad.5.xml:1259
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1261
+#: sssd-ipa.5.xml:279 sssd-ad.5.xml:1262
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -9911,7 +9927,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1266
+#: sssd-ipa.5.xml:290 sssd-ad.5.xml:1267
 msgid ""
 "Note that <emphasis>dyndns_update_per_family</emphasis> parameter does not "
 "apply for PTR record updates.  Those updates are always sent separately."
@@ -9923,60 +9939,60 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1277
+#: sssd-ipa.5.xml:301 sssd-ad.5.xml:1278
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1280
+#: sssd-ipa.5.xml:304 sssd-ad.5.xml:1281
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1284
+#: sssd-ipa.5.xml:308 sssd-ad.5.xml:1285
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1320
+#: sssd-ipa.5.xml:314 sssd-ad.5.xml:1321
 msgid "dyndns_server (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1323
+#: sssd-ipa.5.xml:317 sssd-ad.5.xml:1324
 msgid ""
 "The DNS server to use when performing a DNS update. In most setups, it's "
 "recommended to leave this option unset."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1328
+#: sssd-ipa.5.xml:322 sssd-ad.5.xml:1329
 msgid ""
 "Setting this option makes sense for environments where the DNS server is "
 "different from the identity server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1333
+#: sssd-ipa.5.xml:327 sssd-ad.5.xml:1334
 msgid ""
 "Please note that this option will be only used in fallback attempt when "
 "previous attempt using autodetected settings failed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1338
+#: sssd-ipa.5.xml:332 sssd-ad.5.xml:1339
 msgid "Default: None (let nsupdate choose the server)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1344
+#: sssd-ipa.5.xml:338 sssd-ad.5.xml:1345
 msgid "dyndns_update_per_family (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1347
+#: sssd-ipa.5.xml:341 sssd-ad.5.xml:1348
 msgid ""
 "DNS update is by default performed in two steps - IPv4 update and then IPv6 "
 "update. In some cases it might be desirable to perform IPv4 and IPv6 update "
@@ -10124,26 +10140,26 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1362
+#: sssd-ipa.5.xml:546 sssd-ad.5.xml:1363
 msgid "krb5_confd_path (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1365
+#: sssd-ipa.5.xml:549 sssd-ad.5.xml:1366
 msgid ""
 "Absolute path of a directory where SSSD should place Kerberos configuration "
 "snippets."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1369
+#: sssd-ipa.5.xml:553 sssd-ad.5.xml:1370
 msgid ""
 "To disable the creation of the configuration snippets set the parameter to "
 "'none'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1373
+#: sssd-ipa.5.xml:557 sssd-ad.5.xml:1374
 msgid ""
 "Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)"
 msgstr ""
@@ -10162,7 +10178,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:599
+#: sssd-ipa.5.xml:574 sssd-ipa.5.xml:604 sssd-ipa.5.xml:620 sssd-ad.5.xml:600
 msgid "Default: 5 (seconds)"
 msgstr ""
 
@@ -10877,14 +10893,16 @@ msgstr ""
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:261
 msgid ""
-"This option specifies LDAP access control filter that the user must match in "
-"order to be allowed access. Please note that the <quote>access_provider</"
-"quote> option must be explicitly set to <quote>ad</quote> in order for this "
-"option to have an effect."
+"Specifies an LDAP access control filter that a user must match to gain "
+"access. The <quote>access_provider</quote> option must be explicitly set to "
+"<quote>ad</quote> for this option to take effect. If you want to use the "
+"<quote>ad_access_filter</quote> as the only access control scheme, you must "
+"disable GPO based access control (see option <quote>ad_gpo_access_control</"
+"quote> for details)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:269
+#: sssd-ad.5.xml:270
 msgid ""
 "The option also supports specifying different filters per domain or forest. "
 "This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
@@ -10893,7 +10911,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:277
+#: sssd-ad.5.xml:278
 msgid ""
 "If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
 "quote> specifies the domain or subdomain the filter applies to.  If the "
@@ -10902,14 +10920,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:285
+#: sssd-ad.5.xml:286
 msgid ""
 "Multiple filters can be separated with the <quote>?</quote> character, "
 "similarly to how search bases work."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:290
+#: sssd-ad.5.xml:291
 msgid ""
 "Nested group membership must be searched for using a special OID "
 "<quote>:1.2.840.113556.1.4.1941:</quote> in addition to the full DOM:domain."
@@ -10922,7 +10940,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:303
+#: sssd-ad.5.xml:304
 msgid ""
 "The most specific match is always used. For example, if the option specified "
 "filter for a domain the user is a member of and a global filter, the per-"
@@ -10931,7 +10949,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
-#: sssd-ad.5.xml:314
+#: sssd-ad.5.xml:315
 #, no-wrap
 msgid ""
 "# apply filter on domain called dom1 only:\n"
@@ -10949,24 +10967,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:334
 msgid "ad_site (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:336
+#: sssd-ad.5.xml:337
 msgid ""
 "Specify AD site to which client should try to connect.  If this option is "
 "not provided, the AD site will be auto-discovered."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:347
+#: sssd-ad.5.xml:348
 msgid "ad_enable_gc (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:350
+#: sssd-ad.5.xml:351
 msgid ""
 "By default, the SSSD connects to the Global Catalog first to retrieve users "
 "from trusted domains and uses the LDAP port to retrieve group memberships or "
@@ -10975,7 +10993,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:358
+#: sssd-ad.5.xml:359
 msgid ""
 "Please note that disabling Global Catalog support does not disable "
 "retrieving users from trusted domains. The SSSD would connect to the LDAP "
@@ -10984,12 +11002,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:372
+#: sssd-ad.5.xml:373
 msgid "ad_gpo_access_control (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:375
+#: sssd-ad.5.xml:376
 msgid ""
 "This option specifies the operation mode for GPO-based access control "
 "functionality: whether it operates in disabled mode, enforcing mode, or "
@@ -10999,7 +11017,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:384
+#: sssd-ad.5.xml:385
 msgid ""
 "GPO-based access control functionality uses GPO policy settings to determine "
 "whether or not a particular user is allowed to logon to the host.  For more "
@@ -11008,7 +11026,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:392
+#: sssd-ad.5.xml:393
 msgid ""
 "Please note that current version of SSSD does not support Active Directory's "
 "built-in groups.  Built-in groups (such as Administrators with SID "
@@ -11017,7 +11035,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:401
+#: sssd-ad.5.xml:402
 msgid ""
 "Before performing access control SSSD applies group policy security "
 "filtering on the GPOs. For every single user login, the applicability of the "
@@ -11027,21 +11045,21 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:411
+#: sssd-ad.5.xml:412
 msgid ""
 "Read: The user or one of its groups must have read access to the properties "
 "of the GPO (RIGHT_DS_READ_PROPERTY)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:418
+#: sssd-ad.5.xml:419
 msgid ""
 "Apply Group Policy: The user or at least one of its groups must be allowed "
 "to apply the GPO (RIGHT_DS_CONTROL_ACCESS)."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:426
+#: sssd-ad.5.xml:427
 msgid ""
 "By default, the Authenticated Users group is present on a GPO and this group "
 "has both Read and Apply Group Policy access rights. Since authentication of "
@@ -11051,7 +11069,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:435
+#: sssd-ad.5.xml:436
 msgid ""
 "NOTE: If the operation mode is set to enforcing, it is possible that users "
 "that were previously allowed logon access will now be denied logon access "
@@ -11066,23 +11084,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:454
+#: sssd-ad.5.xml:455
 msgid "There are three supported values for this option:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:458
+#: sssd-ad.5.xml:459
 msgid ""
 "disabled: GPO-based access control rules are neither evaluated nor enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:464
+#: sssd-ad.5.xml:465
 msgid "enforcing: GPO-based access control rules are evaluated and enforced."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:470
+#: sssd-ad.5.xml:471
 msgid ""
 "permissive: GPO-based access control rules are evaluated, but not enforced.  "
 "Instead, a syslog message will be emitted indicating that the user would "
@@ -11090,22 +11108,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:481
+#: sssd-ad.5.xml:482
 msgid "Default: permissive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:484
+#: sssd-ad.5.xml:485
 msgid "Default: enforcing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:490
+#: sssd-ad.5.xml:491
 msgid "ad_gpo_implicit_deny (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:493
+#: sssd-ad.5.xml:494
 msgid ""
 "Normally when no applicable GPOs are found the users are allowed access. "
 "When this option is set to True users will be allowed access only when "
@@ -11116,7 +11134,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:509
+#: sssd-ad.5.xml:510
 msgid ""
 "The following 2 tables should illustrate when a user is allowed or rejected "
 "based on the allow and deny login rights defined on the server-side and the "
@@ -11124,74 +11142,74 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:521
+#: sssd-ad.5.xml:522
 msgid "ad_gpo_implicit_deny = False (default)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "allow-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:522 sssd-ad.5.xml:548
+#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
 msgid "deny-rules"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:523 sssd-ad.5.xml:549
+#: sssd-ad.5.xml:524 sssd-ad.5.xml:550
 msgid "results"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:526 sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:552
-#: sssd-ad.5.xml:555 sssd-ad.5.xml:558
+#: sssd-ad.5.xml:527 sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:553
+#: sssd-ad.5.xml:556 sssd-ad.5.xml:559
 msgid "missing"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:527
+#: sssd-ad.5.xml:528
 msgid "all users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry>
-#: sssd-ad.5.xml:529 sssd-ad.5.xml:532 sssd-ad.5.xml:535 sssd-ad.5.xml:555
-#: sssd-ad.5.xml:558 sssd-ad.5.xml:561
+#: sssd-ad.5.xml:530 sssd-ad.5.xml:533 sssd-ad.5.xml:536 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:559 sssd-ad.5.xml:562
 msgid "present"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:530
+#: sssd-ad.5.xml:531
 msgid "only users not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:533 sssd-ad.5.xml:559
+#: sssd-ad.5.xml:534 sssd-ad.5.xml:560
 msgid "only users in allow-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:536 sssd-ad.5.xml:562
+#: sssd-ad.5.xml:537 sssd-ad.5.xml:563
 msgid "only users in allow-rules and not in deny-rules are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><thead><row><entry>
-#: sssd-ad.5.xml:547
+#: sssd-ad.5.xml:548
 msgid "ad_gpo_implicit_deny = True"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><informaltable><tgroup><tbody><row><entry><para>
-#: sssd-ad.5.xml:553 sssd-ad.5.xml:556
+#: sssd-ad.5.xml:554 sssd-ad.5.xml:557
 msgid "no users are allowed"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:569
+#: sssd-ad.5.xml:570
 msgid "ad_gpo_ignore_unreadable (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:572
+#: sssd-ad.5.xml:573
 msgid ""
 "Normally when some group policy containers (AD object) of applicable group "
 "policy objects are not readable by SSSD then users are denied access.  This "
@@ -11201,12 +11219,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:589
+#: sssd-ad.5.xml:590
 msgid "ad_gpo_cache_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:592
+#: sssd-ad.5.xml:593
 msgid ""
 "The amount of time between lookups of GPO policy files against the AD "
 "server. This will reduce the latency and load on the AD server if there are "
@@ -11214,12 +11232,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:605
+#: sssd-ad.5.xml:606
 msgid "ad_gpo_map_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:608
+#: sssd-ad.5.xml:609
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the InteractiveLogonRight and "
@@ -11235,14 +11253,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:626
+#: sssd-ad.5.xml:627
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on locally\" and \"Deny log on locally\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:640
+#: sssd-ad.5.xml:641
 #, no-wrap
 msgid ""
 "ad_gpo_map_interactive = +my_pam_service, -login\n"
@@ -11250,7 +11268,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:631
+#: sssd-ad.5.xml:632
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11262,42 +11280,42 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:663
+#: sssd-ad.5.xml:664
 msgid "gdm-fingerprint"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:683
+#: sssd-ad.5.xml:684
 msgid "lightdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:688
+#: sssd-ad.5.xml:689
 msgid "lxdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:693
+#: sssd-ad.5.xml:694
 msgid "sddm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:698
+#: sssd-ad.5.xml:699
 msgid "unity"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:703
+#: sssd-ad.5.xml:704
 msgid "xdm"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:712
+#: sssd-ad.5.xml:713
 msgid "ad_gpo_map_remote_interactive (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:715
+#: sssd-ad.5.xml:716
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the RemoteInteractiveLogonRight and "
@@ -11313,7 +11331,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:734
+#: sssd-ad.5.xml:735
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on through Remote Desktop Services\" and \"Deny log on through Remote "
@@ -11321,7 +11339,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:749
+#: sssd-ad.5.xml:750
 #, no-wrap
 msgid ""
 "ad_gpo_map_remote_interactive = +my_pam_service, -sshd\n"
@@ -11329,7 +11347,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:740
+#: sssd-ad.5.xml:741
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11341,22 +11359,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:757
+#: sssd-ad.5.xml:758
 msgid "sshd"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:762
+#: sssd-ad.5.xml:763
 msgid "cockpit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:771
+#: sssd-ad.5.xml:772
 msgid "ad_gpo_map_network (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:774
+#: sssd-ad.5.xml:775
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the NetworkLogonRight and "
@@ -11372,7 +11390,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:792
+#: sssd-ad.5.xml:793
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Access "
 "this computer from the network\" and \"Deny access to this computer from the "
@@ -11380,7 +11398,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:807
+#: sssd-ad.5.xml:808
 #, no-wrap
 msgid ""
 "ad_gpo_map_network = +my_pam_service, -ftp\n"
@@ -11388,7 +11406,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:798
+#: sssd-ad.5.xml:799
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11400,22 +11418,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:815
+#: sssd-ad.5.xml:816
 msgid "ftp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:820
+#: sssd-ad.5.xml:821
 msgid "samba"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:829
+#: sssd-ad.5.xml:830
 msgid "ad_gpo_map_batch (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:832
+#: sssd-ad.5.xml:833
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the BatchLogonRight and DenyBatchLogonRight "
@@ -11430,14 +11448,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:850
+#: sssd-ad.5.xml:851
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a batch job\" and \"Deny log on as a batch job\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:864
+#: sssd-ad.5.xml:865
 #, no-wrap
 msgid ""
 "ad_gpo_map_batch = +my_pam_service, -crond\n"
@@ -11445,7 +11463,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:855
+#: sssd-ad.5.xml:856
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11457,23 +11475,23 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:867
+#: sssd-ad.5.xml:868
 msgid ""
 "Note: Cron service name may differ depending on Linux distribution used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:873
+#: sssd-ad.5.xml:874
 msgid "crond"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:882
+#: sssd-ad.5.xml:883
 msgid "ad_gpo_map_service (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:885
+#: sssd-ad.5.xml:886
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access "
 "control is evaluated based on the ServiceLogonRight and "
@@ -11489,14 +11507,14 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:903
+#: sssd-ad.5.xml:904
 msgid ""
 "Note: Using the Group Policy Management Editor this value is called \"Allow "
 "log on as a service\" and \"Deny log on as a service\"."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:916
+#: sssd-ad.5.xml:917
 #, no-wrap
 msgid ""
 "ad_gpo_map_service = +my_pam_service\n"
@@ -11504,7 +11522,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:908 sssd-ad.5.xml:983
+#: sssd-ad.5.xml:909 sssd-ad.5.xml:984
 msgid ""
 "It is possible to add a PAM service name to the default set by using "
 "<quote>+service_name</quote>.  Since the default set is empty, it is not "
@@ -11515,19 +11533,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:926
+#: sssd-ad.5.xml:927
 msgid "ad_gpo_map_permit (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:929
+#: sssd-ad.5.xml:930
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always granted, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:943
+#: sssd-ad.5.xml:944
 #, no-wrap
 msgid ""
 "ad_gpo_map_permit = +my_pam_service, -sudo\n"
@@ -11535,7 +11553,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:934
+#: sssd-ad.5.xml:935
 msgid ""
 "It is possible to add another PAM service name to the default set by using "
 "<quote>+service_name</quote> or to explicitly remove a PAM service name from "
@@ -11547,29 +11565,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:951
+#: sssd-ad.5.xml:952
 msgid "polkit-1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:966
+#: sssd-ad.5.xml:967
 msgid "systemd-user"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:975
+#: sssd-ad.5.xml:976
 msgid "ad_gpo_map_deny (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:978
+#: sssd-ad.5.xml:979
 msgid ""
 "A comma-separated list of PAM service names for which GPO-based access is "
 "always denied, regardless of any GPO Logon Rights."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><programlisting>
-#: sssd-ad.5.xml:991
+#: sssd-ad.5.xml:992
 #, no-wrap
 msgid ""
 "ad_gpo_map_deny = +my_pam_service\n"
@@ -11577,12 +11595,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1001
+#: sssd-ad.5.xml:1002
 msgid "ad_gpo_default_right (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1004
+#: sssd-ad.5.xml:1005
 msgid ""
 "This option defines how access control is evaluated for PAM service names "
 "that are not explicitly listed in one of the ad_gpo_map_* options. This "
@@ -11595,52 +11613,52 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1017
+#: sssd-ad.5.xml:1018
 msgid "Supported values for this option include:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1026
+#: sssd-ad.5.xml:1027
 msgid "remote_interactive"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1031
+#: sssd-ad.5.xml:1032
 msgid "network"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1036
+#: sssd-ad.5.xml:1037
 msgid "batch"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1041
+#: sssd-ad.5.xml:1042
 msgid "service"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1046
+#: sssd-ad.5.xml:1047
 msgid "permit"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><itemizedlist><listitem><para>
-#: sssd-ad.5.xml:1051
+#: sssd-ad.5.xml:1052
 msgid "deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1057
+#: sssd-ad.5.xml:1058
 msgid "Default: deny"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1063
+#: sssd-ad.5.xml:1064
 msgid "ad_maximum_machine_account_password_age (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1066
+#: sssd-ad.5.xml:1067
 msgid ""
 "SSSD will check once a day if the machine account password is older than the "
 "given age in days and try to renew it. A value of 0 will disable the renewal "
@@ -11648,17 +11666,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1072
+#: sssd-ad.5.xml:1073
 msgid "Default: 30 days"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1078
+#: sssd-ad.5.xml:1079
 msgid "ad_machine_account_password_renewal_opts (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1081
+#: sssd-ad.5.xml:1082
 msgid ""
 "This option should only be used to test the machine account renewal task. "
 "The option expects 2 integers separated by a colon (':'). The first integer "
@@ -11668,17 +11686,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1090
+#: sssd-ad.5.xml:1091
 msgid "Default: 86400:750 (24h and 15m)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1096
+#: sssd-ad.5.xml:1097
 msgid "ad_update_samba_machine_account_password (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1099
+#: sssd-ad.5.xml:1100
 msgid ""
 "If enabled, when SSSD renews the machine account password, it will also be "
 "updated in Samba's database. This prevents Samba's copy of the machine "
@@ -11687,12 +11705,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1112
+#: sssd-ad.5.xml:1113
 msgid "ad_use_ldaps (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1115
+#: sssd-ad.5.xml:1116
 msgid ""
 "By default SSSD uses the plain LDAP port 389 and the Global Catalog port "
 "3628. If this option is set to True SSSD will use the LDAPS port 636 and "
@@ -11703,12 +11721,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:1132
+#: sssd-ad.5.xml:1133
 msgid "ad_allow_remote_domain_local_groups (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1135
+#: sssd-ad.5.xml:1136
 msgid ""
 "If this option is set to <quote>true</quote> SSSD will not filter out Domain "
 "Local groups from remote domains in the AD forest. By default they are "
@@ -11719,7 +11737,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1145
+#: sssd-ad.5.xml:1146
 msgid ""
 "Please note that setting this option to <quote>true</quote> will be against "
 "the intention of Domain Local group in Active Directory and <emphasis>SHOULD "
@@ -11734,7 +11752,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1161
+#: sssd-ad.5.xml:1162
 msgid ""
 "Given the comments above, if this option is set to <quote>true</quote> the "
 "tokenGroups request must be disabled by setting <quote>ldap_use_tokengroups</"
@@ -11746,7 +11764,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1184
+#: sssd-ad.5.xml:1185
 msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
@@ -11757,19 +11775,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1214
+#: sssd-ad.5.xml:1215
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1230
+#: sssd-ad.5.xml:1231
 msgid ""
 "Default: Use the IP addresses of the interface which is used for AD LDAP "
 "connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:1243
+#: sssd-ad.5.xml:1244
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -11779,7 +11797,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1393
+#: sssd-ad.5.xml:1394
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -11787,7 +11805,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1400
+#: sssd-ad.5.xml:1401
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -11802,7 +11820,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:1420
+#: sssd-ad.5.xml:1421
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -11811,7 +11829,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1416
+#: sssd-ad.5.xml:1417
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -11819,7 +11837,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1426
+#: sssd-ad.5.xml:1427
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>. Please "
@@ -11829,7 +11847,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:1434
+#: sssd-ad.5.xml:1435
 msgid ""
 "When the autofs provider is set to <quote>ad</quote>, the RFC2307 schema "
 "attribute mapping (nisMap, nisObject, ...) is used, because these attributes "
@@ -12312,74 +12330,87 @@ msgid ""
 "directly."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sssd.8.xml:208
+msgid "SIGRTMIN+1"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sssd.8.xml:211
+msgid ""
+"Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends "
+"this signal to the providers when a clock shift is detected although it can "
+"be sent to any sssd_be process directly."
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.8.xml:211 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:75
+#: sssd.8.xml:223 sss_ssh_authorizedkeys.1.xml:141 sss_ssh_knownhosts.1.xml:113
 #: sss_ssh_knownhostsproxy.1.xml:112
 msgid "EXIT STATUS"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:214
+#: sssd.8.xml:226
 msgid "0"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:217
+#: sssd.8.xml:229
 msgid "SSSD was shutdown gracefully."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refmeta><manvolnum>
-#: sssd.8.xml:222 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
+#: sssd.8.xml:234 sss_ssh_authorizedkeys.1.xml:11 sss_ssh_knownhosts.1.xml:11
 #: sss_ssh_knownhostsproxy.1.xml:11
 msgid "1"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:225
+#: sssd.8.xml:237
 msgid "Bad configuration or command line option."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:230
+#: sssd.8.xml:242
 msgid "2"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:233
+#: sssd.8.xml:245
 msgid "Memory allocation error."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:238
+#: sssd.8.xml:250
 msgid "6"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:241
+#: sssd.8.xml:253
 msgid "SSSD is already running."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
-#: sssd.8.xml:246
+#: sssd.8.xml:258
 msgid "Other codes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
-#: sssd.8.xml:249
+#: sssd.8.xml:261
 msgid ""
 "Other codes denote different errors, most probably about missing required "
 "access rights. See SSSD and system logs for details."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:260
+#: sssd.8.xml:272
 msgid ""
 "If the environment variable SSS_NSS_USE_MEMCACHE is set to \"NO\", client "
 "applications will not use the fast in-memory cache."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd.8.xml:264
+#: sssd.8.xml:276
 msgid ""
 "If the environment variable SSS_LOCKFREE is set to \"NO\", requests from "
 "multiple threads of a single application will be serialized."
@@ -14174,7 +14205,7 @@ msgstr ""
 #: sss_ssh_knownhosts.1.xml:47
 #, no-wrap
 msgid ""
-"              KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
+"                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H\n"
 "            "
 msgstr ""
 
@@ -14195,8 +14226,57 @@ msgid ""
 "Search for host public keys in SSSD domain <replaceable>DOMAIN</replaceable>."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><term>
+#: sss_ssh_knownhosts.1.xml:72
+msgid "<option>-o</option>,<option>--only-host-name</option>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><variablelist><varlistentry><listitem><para>
+#: sss_ssh_knownhosts.1.xml:76
+msgid ""
+"When the keys retrieved from the backend do not include the hostname, this "
+"tool will add the unmodified hostname as provided by the caller. If this "
+"flag is set, only the hostname (no port number) will be added to the keys."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><title>
+#: sss_ssh_knownhosts.1.xml:88
+msgid "KEY RETRIEVAL"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:90
+msgid ""
+"The key lines retrieved from the backend are expected to respect the key "
+"format as decribed in the <quote>SSH_KNOWN_HOSTS FILE FORMAT</quote> section "
+"of <citerefentry><refentrytitle>sshd</refentrytitle> <manvolnum>8</"
+"manvolnum></citerefentry>. However, returning only the keytype and the key "
+"itself is tolerated, in which case, the hostname received as parameter will "
+"be added before the keytype to output a correctly formatted line. The "
+"hostname will be added unmodified or just the hostname (no port number), "
+"depending on whether the <option>-o</option>,<option>--only-host-name</"
+"option> option was provided."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><programlisting>
+#: sss_ssh_knownhosts.1.xml:107
+#, no-wrap
+msgid ""
+"                [canonical.host.name]:2222 &lt;keytype&gt; &lt;base64-encoded key&gt;\n"
+"            "
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sss_ssh_knownhosts.1.xml:77
+#: sss_ssh_knownhosts.1.xml:102
+msgid ""
+"When the SSH server is listening on a non-default port, the backend MUST "
+"provide the hostname including the port number in the correct format and "
+"position as part of the key line. For example, the minimal key line would "
+"be: <placeholder type=\"programlisting\" id=\"0\"/>"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para>
+#: sss_ssh_knownhosts.1.xml:115
 msgid ""
 "In case of successful execution, even if no key was found, 0 is returned. 1 "
 "is returned in case of error."
@@ -17865,14 +17945,13 @@ msgid ""
 "<refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>1</"
 "manvolnum> </citerefentry>, <citerefentry> "
 "<refentrytitle>sss_ssh_knownhosts</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry>, </phrase> <phrase condition=\"with_ifp\"> <citerefentry> "
-"<refentrytitle>sssd-ifp</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry>, </phrase> <citerefentry> <refentrytitle>pam_sss</"
-"refentrytitle><manvolnum>8</manvolnum> </citerefentry>.  <citerefentry> "
-"<refentrytitle>sss_rpcidmapd</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> <phrase condition=\"with_stap\"> <citerefentry> "
-"<refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</manvolnum> </"
-"citerefentry> </phrase>"
+"citerefentry>, </phrase> <citerefentry> <refentrytitle>sssd-ifp</"
+"refentrytitle> <manvolnum>5</manvolnum> </citerefentry>, <citerefentry> "
+"<refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum> </"
+"citerefentry>.  <citerefentry> <refentrytitle>sss_rpcidmapd</refentrytitle> "
+"<manvolnum>5</manvolnum> </citerefentry> <phrase condition=\"with_stap\"> "
+"<citerefentry> <refentrytitle>sssd-systemtap</refentrytitle> <manvolnum>5</"
+"manvolnum> </citerefentry> </phrase>"
 msgstr ""
 
 #. type: Content of: <listitem><para>

From 217b3fad3aa5b15879f7393ea1ac0ab137c2c4ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Tue, 15 Oct 2024 11:26:35 +0200
Subject: [PATCH 050/129] Release sssd-2.10.0

---
 version.m4 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.m4 b/version.m4
index 61a38fee95b..9fe14a734b3 100644
--- a/version.m4
+++ b/version.m4
@@ -1,5 +1,5 @@
 # Primary version number
-m4_define([VERSION_NUMBER], [2.10.0-beta2])
+m4_define([VERSION_NUMBER], [2.10.0])
 
 # If the PRERELEASE_VERSION_NUMBER is set, we'll append
 # it to the release tag when creating an RPM or SRPM

From 0e8e6946b77c78c61e0d63c37ee2bb8ae2c9f1ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Tue, 15 Oct 2024 11:58:35 +0200
Subject: [PATCH 051/129] Update version in version.m4 to track the next
 release

---
 version.m4 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.m4 b/version.m4
index 9fe14a734b3..023beedcab0 100644
--- a/version.m4
+++ b/version.m4
@@ -1,5 +1,5 @@
 # Primary version number
-m4_define([VERSION_NUMBER], [2.10.0])
+m4_define([VERSION_NUMBER], [2.11.0])
 
 # If the PRERELEASE_VERSION_NUMBER is set, we'll append
 # it to the release tag when creating an RPM or SRPM

From 247797b2ac557f981581cf66b57ea029d8230c4e Mon Sep 17 00:00:00 2001
From: Madhuri Upadhye <mupadhye@redhat.com>
Date: Tue, 24 Sep 2024 11:34:56 +0530
Subject: [PATCH 052/129] Tests: sss_ssh_knownhosts with port number
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add tests cases with port numbers

Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tests/system/tests/test_ipa.py | 90 ++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)

diff --git a/src/tests/system/tests/test_ipa.py b/src/tests/system/tests/test_ipa.py
index c564ff9b619..da7dd0e975c 100644
--- a/src/tests/system/tests/test_ipa.py
+++ b/src/tests/system/tests/test_ipa.py
@@ -127,6 +127,96 @@ def test_ipa__hostpublickeys_by_ip(client: Client, ipa: IPA, public_keys: list[s
         assert f"{ip} {key}" in result.stdout_lines, "Did not get expected public keys!"
 
 
+@pytest.mark.ticket(gh=7583)
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.parametrize("option", [(None), ("-o")])
+@pytest.mark.builtwith(client="knownhosts", ipa="knownhosts")
+def test_ipa__hostpublickeys_by_name_with_port(client: Client, ipa: IPA, public_keys: list[str], option: str | None):
+    """
+    :title: sss_ssh_knownhosts returns public keys by host name with port
+    :setup:
+        1. Create host with SSH key
+        2. Configure SSSD with SSH responder
+        3. Start SSSD
+    :steps:
+        1. Lookup SSH key
+    :expectedresults:
+        1. All public keys were printed
+    :customerscenario: False
+    """
+    hostname = f"ssh-host.{ipa.domain}"
+    ip = "10.255.251.10"
+    port = 3333
+
+    ipa.host_account(hostname).add(ip=ip, sshpubkey=public_keys)
+    client.sssd.enable_responder("ssh")
+    client.sssd.start()
+
+    args = []
+    if option is not None:
+        args.append(option)
+    args.append(f"[{hostname}]:{port}")
+
+    result = client.sss_ssh_knownhosts(*args)
+    assert result.rc == 0, "Did not get OpenSSH known hosts public keys!"
+    assert len(public_keys) == len(result.stdout_lines), "Did not get expected number of public keys!"
+    for key in public_keys:
+        if option == "-o":
+            output = f"{hostname} {key}"
+        else:
+            output = f"[{hostname}]:{port} {key}"
+        assert output in result.stdout_lines, "Did not get expected public keys!"
+
+
+@pytest.mark.ticket(gh=7583)
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="knownhosts", ipa="knownhosts")
+def test_ipa__hostpublickeys_with_non_default_port(client: Client, ipa: IPA, public_keys: list[str]):
+    """
+    :title: sss_ssh_knownhosts returns public keys by hostname with non-default port
+    :setup:
+        1. Create host with SSH key
+        2. Add the ipasshpubkey with hostname and port
+        3. Configure SSSD with SSH responder
+        4. Start SSSD
+    :steps:
+        1. Lookup SSH key
+    :expectedresults:
+        1. All public keys were printed
+    :customerscenario: False
+    """
+    hostname = f"ssh-host.{ipa.domain}"
+    ip = "10.255.251.10"
+    port = 4444
+
+    ipa.host_account(hostname).add(ip=ip, sshpubkey=public_keys)
+    client.sssd.enable_responder("ssh")
+    client.sssd.start()
+
+    # IPA doesn't currently ipa host-mod with hostname and key
+    # this is workaround till IPA add the support.
+    for key in public_keys:
+        modify_content = ipa.fs.mktmp(
+            rf"""
+                        dn: fqdn={hostname},cn=computers,cn=accounts,dc=ipa,dc=test
+                        changetype: modify
+                        add: ipaSshPubKey
+                        ipaSshPubKey: [{hostname}]:{port} {key}
+                        """,
+            mode="a=rx",
+        )
+        ipa.host.conn.run(command=f"ldapmodify -H ldap://master.ipa.test -f {modify_content}")
+
+    result = client.sss_ssh_knownhosts(f"[{hostname}]:{port}")
+    assert result.rc == 0, "Did not get OpenSSH known hosts public keys!"
+    for key in public_keys:
+        assert f"[{hostname}]:{port} {key}" in result.stdout_lines, (
+            "Did not get expected public keys with " " the host name with port"
+        )
+
+
 @pytest.mark.ticket(bz=1926622)
 @pytest.mark.integration
 @pytest.mark.importance("low")

From 163b1e3166997e470c539b058628e59a04386db0 Mon Sep 17 00:00:00 2001
From: Madhuri Upadhye <mupadhye@redhat.com>
Date: Mon, 14 Oct 2024 15:57:04 +0530
Subject: [PATCH 053/129] Tests: Mark builtwith for knownhosts tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mark builtwith for sss_ssh_knownhosts tests.
Update the marker of test to high to have basic
coverage in gating.

Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tests/system/tests/test_ipa.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/tests/system/tests/test_ipa.py b/src/tests/system/tests/test_ipa.py
index da7dd0e975c..068bda282c3 100644
--- a/src/tests/system/tests/test_ipa.py
+++ b/src/tests/system/tests/test_ipa.py
@@ -36,8 +36,9 @@ def public_keys(moduledatadir: str) -> list[str]:
 
 
 @pytest.mark.ticket(gh=5518)
-@pytest.mark.importance("low")
+@pytest.mark.importance("high")
 @pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="knownhosts")
 def test_ipa__hostpublickeys_by_name(client: Client, ipa: IPA, public_keys: list[str]):
     """
     :title: sss_ssh_knownhosts returns public keys by name
@@ -68,6 +69,7 @@ def test_ipa__hostpublickeys_by_name(client: Client, ipa: IPA, public_keys: list
 @pytest.mark.ticket(gh=5518)
 @pytest.mark.importance("low")
 @pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="knownhosts")
 def test_ipa__hostpublickeys_by_shortname(client: Client, ipa: IPA, public_keys: list[str]):
     """
     :title: sss_ssh_knownhosts returns public keys by short name using the search domain
@@ -100,6 +102,7 @@ def test_ipa__hostpublickeys_by_shortname(client: Client, ipa: IPA, public_keys:
 @pytest.mark.ticket(gh=5518)
 @pytest.mark.importance("low")
 @pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="knownhosts")
 def test_ipa__hostpublickeys_by_ip(client: Client, ipa: IPA, public_keys: list[str]):
     """
     :title: sss_ssh_knownhosts returns public keys by IP
@@ -131,7 +134,7 @@ def test_ipa__hostpublickeys_by_ip(client: Client, ipa: IPA, public_keys: list[s
 @pytest.mark.importance("low")
 @pytest.mark.topology(KnownTopology.IPA)
 @pytest.mark.parametrize("option", [(None), ("-o")])
-@pytest.mark.builtwith(client="knownhosts", ipa="knownhosts")
+@pytest.mark.builtwith(client="knownhosts")
 def test_ipa__hostpublickeys_by_name_with_port(client: Client, ipa: IPA, public_keys: list[str], option: str | None):
     """
     :title: sss_ssh_knownhosts returns public keys by host name with port
@@ -172,7 +175,7 @@ def test_ipa__hostpublickeys_by_name_with_port(client: Client, ipa: IPA, public_
 @pytest.mark.ticket(gh=7583)
 @pytest.mark.importance("low")
 @pytest.mark.topology(KnownTopology.IPA)
-@pytest.mark.builtwith(client="knownhosts", ipa="knownhosts")
+@pytest.mark.builtwith(client="knownhosts")
 def test_ipa__hostpublickeys_with_non_default_port(client: Client, ipa: IPA, public_keys: list[str]):
     """
     :title: sss_ssh_knownhosts returns public keys by hostname with non-default port

From 934ae04e1387043fc0ac673ec6cf853724e15394 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Thu, 19 Sep 2024 17:48:06 -0400
Subject: [PATCH 054/129] tests: rm intg/test_sss_cache.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* this test is indirectly tested by several tests

Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tests/intg/Makefile.am       |  1 -
 src/tests/intg/test_sss_cache.py | 34 --------------------------------
 2 files changed, 35 deletions(-)
 delete mode 100644 src/tests/intg/test_sss_cache.py

diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 802cbe18b9c..6283a2a9c3c 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -40,7 +40,6 @@ dist_noinst_DATA = \
     conftest.py \
     sssd_hosts.py \
     sssd_nets.py \
-    test_sss_cache.py \
     $(NULL)
 
 EXTRA_DIST = data/cwrap-dbus-system.conf.in
diff --git a/src/tests/intg/test_sss_cache.py b/src/tests/intg/test_sss_cache.py
deleted file mode 100644
index 22f12f07645..00000000000
--- a/src/tests/intg/test_sss_cache.py
+++ /dev/null
@@ -1,34 +0,0 @@
-#
-# SSSD files domain tests
-#
-# Copyright (c) 2019 Red Hat, Inc.
-# Author: Lukas Slebodnik <lslebodn@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import subprocess
-
-
-def test_missing_domains():
-    # Utilities in shadow-utils call sss_cache but it might fail in case
-    # sssd has never been started on such host.
-    ret = subprocess.call(["sss_cache", "-U"])
-    assert ret == 0
-
-    ret = subprocess.call(["sss_cache", "-G"])
-    assert ret == 0
-
-    ret = subprocess.call(["sss_cache", "-E"])
-    assert ret == 0

From 7184541976608d357a5da48d09a7fa08862477d8 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 13 Sep 2024 15:45:59 +0200
Subject: [PATCH 055/129] ldap: add 'exop_force' value for ldap_pwmodify_mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In case the LDAP server allows to run the extended operation to change a
password even if an authenticated bind fails due to missing grace logins
the new option 'exop_force' can be used to run the extended operation to
change the password anyways.

:config: Added `exop_force` value for configuration option
  `ldap_pwmodify_mode`. This can be used to force a password change even
  if no grace logins are left. Depending on the configuration of the
  LDAP server it might be expected that the password change will fail.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/man/sssd-ldap.5.xml                    | 11 +++++++++
 src/providers/ipa/ipa_auth.c               |  3 ++-
 src/providers/ldap/ldap_auth.c             |  5 +++-
 src/providers/ldap/ldap_options.c          |  2 ++
 src/providers/ldap/sdap.h                  |  5 ++--
 src/providers/ldap/sdap_async.h            |  3 ++-
 src/providers/ldap/sdap_async_connection.c | 27 +++++++++++++++++-----
 7 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index a6f9b1c97b9..d50aa65b2c1 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -234,6 +234,17 @@
                                         userPassword (not recommended).
                                     </para>
                                 </listitem>
+                                <listitem>
+                                    <para>
+                                        exop_force - Try Password Modify
+                                        Extended Operation (RFC 3062) even if
+                                        there are no grace logins left.
+                                        Depending on the type and configuration
+                                        of the LDAP server the password change
+                                        might fail because an authenticated bind
+                                        is not possible.
+                                    </para>
+                                </listitem>
                             </itemizedlist>
                         </para>
                         <para>
diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c
index e238d0623de..db1cd6ad39f 100644
--- a/src/providers/ipa/ipa_auth.c
+++ b/src/providers/ipa/ipa_auth.c
@@ -397,7 +397,8 @@ static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq)
                                   SDAP_USE_PPOLICY);
 
     subreq = sdap_auth_send(state, state->ev, sh, NULL, NULL, dn,
-                            state->pd->authtok, timeout, use_ppolicy);
+                            state->pd->authtok, timeout, use_ppolicy,
+                            state->auth_ctx->sdap_auth_ctx->opts->pwmodify_mode);
     if (subreq == NULL) {
         goto done;
     }
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index 9ccbdabdbee..370cdf17188 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -914,7 +914,8 @@ static void auth_do_bind(struct tevent_req *req)
     subreq = sdap_auth_send(state, state->ev, state->sh,
                             NULL, NULL, state->dn,
                             state->authtok,
-                            timeout, use_ppolicy);
+                            timeout, use_ppolicy,
+                            state->ctx->opts->pwmodify_mode);
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
@@ -1208,6 +1209,7 @@ sdap_pam_change_password_send(TALLOC_CTX *mem_ctx,
 
     switch (opts->pwmodify_mode) {
     case SDAP_PWMODIFY_EXOP:
+    case SDAP_PWMODIFY_EXOP_FORCE:
         use_ppolicy = dp_opt_get_bool(opts->basic, SDAP_USE_PPOLICY);
         subreq = sdap_exop_modify_passwd_send(state, ev, sh, user_dn,
                                               password, new_password,
@@ -1252,6 +1254,7 @@ static void sdap_pam_change_password_done(struct tevent_req *subreq)
 
     switch (state->mode) {
     case SDAP_PWMODIFY_EXOP:
+    case SDAP_PWMODIFY_EXOP_FORCE:
         ret = sdap_exop_modify_passwd_recv(subreq, state,
                                            &state->user_error_message);
         break;
diff --git a/src/providers/ldap/ldap_options.c b/src/providers/ldap/ldap_options.c
index 277bcb529fe..72a95300d74 100644
--- a/src/providers/ldap/ldap_options.c
+++ b/src/providers/ldap/ldap_options.c
@@ -294,6 +294,8 @@ int ldap_get_options(TALLOC_CTX *memctx,
         opts->pwmodify_mode = SDAP_PWMODIFY_EXOP;
     } else if (strcasecmp(pwmodify, "ldap_modify") == 0) {
         opts->pwmodify_mode = SDAP_PWMODIFY_LDAP;
+    } else if (strcasecmp(pwmodify, "exop_force") == 0) {
+        opts->pwmodify_mode = SDAP_PWMODIFY_EXOP_FORCE;
     } else {
         DEBUG(SSSDBG_FATAL_FAILURE, "Unrecognized pwmodify mode: %s\n", pwmodify);
         ret = EINVAL;
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index d66ca156afe..35a4d5e1c96 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -550,8 +550,9 @@ struct sdap_options {
 
     /* password modify mode */
     enum pwmodify_mode {
-        SDAP_PWMODIFY_EXOP = 1,     /* pwmodify extended operation */
-        SDAP_PWMODIFY_LDAP = 2      /* ldap_modify of userPassword */
+        SDAP_PWMODIFY_EXOP = 1,      /* pwmodify extended operation */
+        SDAP_PWMODIFY_LDAP = 2,      /* ldap_modify of userPassword */
+        SDAP_PWMODIFY_EXOP_FORCE = 3 /* forced pwmodify extended operation */
     } pwmodify_mode;
 
     /* The search bases for the domain or its subdomain */
diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
index a78a1157ccc..700cd6f9c44 100644
--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
@@ -147,7 +147,8 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
                                   const char *user_dn,
                                   struct sss_auth_token *authtok,
                                   int simple_bind_timeout,
-                                  bool use_ppolicy);
+                                  bool use_ppolicy,
+                                  enum pwmodify_mode pwmodify_mode);
 
 errno_t sdap_auth_recv(struct tevent_req *req,
                        TALLOC_CTX *memctx,
diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index a6d4ee4438b..67c09835b79 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -646,6 +646,7 @@ struct simple_bind_state {
     struct tevent_context *ev;
     struct sdap_handle *sh;
     const char *user_dn;
+    enum pwmodify_mode pwmodify_mode;
 
     struct sdap_op *op;
 
@@ -663,7 +664,8 @@ static struct tevent_req *simple_bind_send(TALLOC_CTX *memctx,
                                            int timeout,
                                            const char *user_dn,
                                            struct berval *pw,
-                                           bool use_ppolicy)
+                                           bool use_ppolicy,
+                                           enum pwmodify_mode pwmodify_mode)
 {
     struct tevent_req *req;
     struct simple_bind_state *state;
@@ -686,6 +688,7 @@ static struct tevent_req *simple_bind_send(TALLOC_CTX *memctx,
     state->ev = ev;
     state->sh = sh;
     state->user_dn = user_dn;
+    state->pwmodify_mode = pwmodify_mode;
 
     if (use_ppolicy) {
         ret = sss_ldap_control_create(LDAP_CONTROL_PASSWORDPOLICYREQUEST,
@@ -872,7 +875,12 @@ static void simple_bind_done(struct sdap_op *op,
                      * Grace Authentications". */
                     DEBUG(SSSDBG_TRACE_LIBS,
                           "Password expired, grace logins exhausted.\n");
-                    ret = ERR_AUTH_FAILED;
+                    if (state->pwmodify_mode == SDAP_PWMODIFY_EXOP_FORCE) {
+                        DEBUG(SSSDBG_TRACE_LIBS, "Password change forced.\n");
+                        ret = ERR_PASSWORD_EXPIRED;
+                    } else {
+                        ret = ERR_AUTH_FAILED;
+                    }
                 }
             } else if (strcmp(response_controls[c]->ldctl_oid,
                               LDAP_CONTROL_PWEXPIRED) == 0) {
@@ -885,7 +893,12 @@ static void simple_bind_done(struct sdap_op *op,
                 if (result == LDAP_INVALID_CREDENTIALS) {
                     DEBUG(SSSDBG_TRACE_LIBS,
                           "Password expired, grace logins exhausted.\n");
-                    ret = ERR_AUTH_FAILED;
+                    if (state->pwmodify_mode == SDAP_PWMODIFY_EXOP_FORCE) {
+                        DEBUG(SSSDBG_TRACE_LIBS, "Password change forced.\n");
+                        ret = ERR_PASSWORD_EXPIRED;
+                    } else {
+                        ret = ERR_AUTH_FAILED;
+                    }
                 } else {
                     DEBUG(SSSDBG_TRACE_LIBS,
                           "Password expired, user must set a new password.\n");
@@ -1365,7 +1378,8 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
                                   const char *user_dn,
                                   struct sss_auth_token *authtok,
                                   int simple_bind_timeout,
-                                  bool use_ppolicy)
+                                  bool use_ppolicy,
+                                  enum pwmodify_mode pwmodify_mode)
 {
     struct tevent_req *req, *subreq;
     struct sdap_auth_state *state;
@@ -1404,7 +1418,7 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
         pw.bv_len = pwlen;
 
         state->is_sasl = false;
-        subreq = simple_bind_send(state, ev, sh, simple_bind_timeout, user_dn, &pw, use_ppolicy);
+        subreq = simple_bind_send(state, ev, sh, simple_bind_timeout, user_dn, &pw, use_ppolicy, pwmodify_mode);
         if (!subreq) {
             tevent_req_error(req, ENOMEM);
             return tevent_req_post(req, ev);
@@ -1981,7 +1995,8 @@ static void sdap_cli_auth_step(struct tevent_req *req)
                             dp_opt_get_int(state->opts->basic,
                                            SDAP_OPT_TIMEOUT),
                             dp_opt_get_bool(state->opts->basic,
-                                            SDAP_USE_PPOLICY));
+                                            SDAP_USE_PPOLICY),
+                            state->opts->pwmodify_mode);
     talloc_free(authtok);
     if (!subreq) {
         tevent_req_error(req, ENOMEM);

From deefe9ad82e8e0057aa77ea5be60a86d223900da Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 27 Sep 2024 16:54:42 +0200
Subject: [PATCH 056/129] tests: add 'expo_force' tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The new value for the ldap_pwmodify_mode option 'exop_force' is added to
existing test. A new test to illustrate the different behavior of 'exop'
and 'exop_force' is added.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/tests/system/tests/test_ldap.py | 58 +++++++++++++++++++++++++++--
 1 file changed, 54 insertions(+), 4 deletions(-)

diff --git a/src/tests/system/tests/test_ldap.py b/src/tests/system/tests/test_ldap.py
index 3d8b35a451c..251663e5f65 100644
--- a/src/tests/system/tests/test_ldap.py
+++ b/src/tests/system/tests/test_ldap.py
@@ -16,7 +16,7 @@
 
 @pytest.mark.ticket(bz=[795044, 1695574])
 @pytest.mark.importance("critical")
-@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify"])
+@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify", "exop_force"])
 @pytest.mark.parametrize("use_ppolicy", ["true", "false"])
 @pytest.mark.parametrize("sssd_service_user", ("root", "sssd"))
 @pytest.mark.topology(KnownTopology.LDAP)
@@ -75,7 +75,7 @@ def test_ldap__password_change_using_ppolicy(
 
 @pytest.mark.ticket(bz=[795044, 1695574])
 @pytest.mark.importance("critical")
-@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify"])
+@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify", "exop_force"])
 @pytest.mark.parametrize("use_ppolicy", ["true", "false"])
 @pytest.mark.topology(KnownTopology.LDAP)
 @pytest.mark.builtwith("ldap_use_ppolicy")
@@ -109,7 +109,7 @@ def test_ldap__password_change_new_passwords_do_not_match_using_ppolicy(
 
 @pytest.mark.ticket(bz=[795044, 1695574, 1795220])
 @pytest.mark.importance("critical")
-@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify"])
+@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify", "exop_force"])
 @pytest.mark.parametrize("use_ppolicy", ["true", "false"])
 @pytest.mark.topology(KnownTopology.LDAP)
 @pytest.mark.builtwith("ldap_use_ppolicy")
@@ -150,7 +150,7 @@ def test_ldap__password_change_new_password_does_not_meet_complexity_requirement
 
 @pytest.mark.ticket(bz=[1695574, 1795220])
 @pytest.mark.importance("critical")
-@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify"])
+@pytest.mark.parametrize("modify_mode", ["exop", "ldap_modify", "exop_force"])
 @pytest.mark.parametrize("use_ppolicy", ["true", "false"])
 @pytest.mark.topology(KnownTopology.LDAP)
 @pytest.mark.builtwith("ldap_use_ppolicy")
@@ -452,3 +452,53 @@ def test_ldap__lookup_and_authenticate_as_user_with_different_object_search_base
     assert result is not None, "User is not found!"
     assert result.name == user.name, "Username is not correct!"
     assert client.auth.ssh.password(user.name, "Secret123"), "User login failed!"
+
+
+@pytest.mark.ticket(jira="RHEL-55993")
+@pytest.mark.importance("critical")
+@pytest.mark.parametrize(
+    "modify_mode, expected, err_msg",
+    [("exop", 1, "Expected login failure"), ("exop_force", 3, "Expected password change request")],
+)
+@pytest.mark.parametrize("method", ["su", "ssh"])
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_ldap__password_change_no_grace_logins_left(
+    client: Client, ldap: LDAP, modify_mode: str, expected: int, err_msg: str, method: str
+):
+    """
+    :title: Password change when no grace logins left
+    :description: Typically the LDAP extended operation to change a password
+    requires an authenticated bind, even if the data send with the extended
+    operation contains the old password. If the old password is expired and
+    there are no grace logins left an authenticated bind is not possible anymore
+    and as a result it is not possible for the user to change their password.
+    With 'exop' SSSD will not try to ask the user for new credentials while with
+    'exop_force' SSSD will ask for new credentials and will try to run the password
+    change extended operation.
+    :setup:
+        1. Set "passwordExp" to "on"
+        2. Set "passwordMaxAge" to "1"
+        3. Set "passwordGraceLimit" to "0"
+        4. Add a user to LDAP
+        5. Wait until the password is expired
+        6. Set "ldap_pwmodify_mode"
+        7. Start SSSD
+    :steps:
+        1. Authenticate as the user with 'exop_force' set
+        2. Authenticate as the user with 'exop' set
+    :expectedresults:
+        1. With 'exop_force' expect a request to change the password
+        2. With 'exop' expect just a failed login
+    :customerscenario: False
+    """
+    ldap.ldap.modify("cn=config", replace={"passwordExp": "on", "passwordMaxAge": "1", "passwordGraceLimit": "0"})
+    ldap.user("user1").add(password="Secret123")
+
+    # make sure the password is expired
+    time.sleep(3)
+
+    client.sssd.domain["ldap_pwmodify_mode"] = modify_mode
+    client.sssd.start()
+
+    rc, _, _, _ = client.auth.parametrize(method).password_with_output("user1", "Secret123")
+    assert rc == expected, err_msg

From 94e47c5ce9b06b0ce8e527607c3e1e221e823841 Mon Sep 17 00:00:00 2001
From: Madhuri Upadhye <mupadhye@redhat.com>
Date: Fri, 20 Sep 2024 16:42:29 +0530
Subject: [PATCH 057/129] Test: Passkey test cases with diffferent auth_methods
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added following test cases
1. Check authentication of user with IPA server when
no pin set for the Passkey.
2. Check authentication of user with updated prompting
options
3. Check password authentication of user with IPA server
when sssd fall back to password authentication

Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 .../passkey-mapping.ipa                       |   1 +
 .../umockdev.script.ipa                       |  30 ++++
 .../passkey-mapping.ipa                       |   1 +
 .../umockdev.script.ipa                       |  29 ++++
 .../passkey-mapping.ipa                       |   1 +
 .../umockdev.script.ipa                       |  18 +++
 src/tests/system/tests/test_passkey.py        | 147 ++++++++++++++++++
 7 files changed, 227 insertions(+)
 create mode 100644 src/tests/system/data/test_passkey/test_passkey__prompt_options/passkey-mapping.ipa
 create mode 100644 src/tests/system/data/test_passkey/test_passkey__prompt_options/umockdev.script.ipa
 create mode 100644 src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/passkey-mapping.ipa
 create mode 100644 src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/umockdev.script.ipa
 create mode 100644 src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/passkey-mapping.ipa
 create mode 100644 src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/umockdev.script.ipa

diff --git a/src/tests/system/data/test_passkey/test_passkey__prompt_options/passkey-mapping.ipa b/src/tests/system/data/test_passkey/test_passkey__prompt_options/passkey-mapping.ipa
new file mode 100644
index 00000000000..a89bee8a504
--- /dev/null
+++ b/src/tests/system/data/test_passkey/test_passkey__prompt_options/passkey-mapping.ipa
@@ -0,0 +1 @@
+passkey:bjxRHsB/AXOOfZSeofVLuJZymEVMlNIica/jDaBQ2Ku+tFgaRnmk1q6c0t8OeX4ykiWs0J39SjySi142Kuw8tA==,MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2dKjseUv7dBMVB1+kGrkuFkMM9pblYf6wyo5V4Ue2HN49oRD9/mDx8WDZP4nl8yRuKVEJMoMRwCy2GPEcW+YjQ==
diff --git a/src/tests/system/data/test_passkey/test_passkey__prompt_options/umockdev.script.ipa b/src/tests/system/data/test_passkey/test_passkey__prompt_options/umockdev.script.ipa
new file mode 100644
index 00000000000..0e88c0f935e
--- /dev/null
+++ b/src/tests/system/data/test_passkey/test_passkey__prompt_options/umockdev.script.ipa
@@ -0,0 +1,30 @@
+d 0 /dev/hidraw1
+
+w 2 ^@�����^@^H^A^A^A^A^A^A^A^A^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 3 �����^@^Q^A^A^A^A^A^A^A^A�ˏ-^B^E^D^C^E^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 1 ^@�ˏ-�^@^A^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 2 �ˏ-�^@�^@�^A�fU2F_V2hFIDO_2_0lFIDO_2_1_PRE^B�kcredProtectkhmac-secr�ˏ-^@et^CP/�W��^SG�^V�Z�� *^D�brk�bup�dplat�iclientPin�ucredentialM�ˏ-^AgmtPreview�^E^Y^D�^F�^B^A^G^H^H^X�^I�cnfccusb^J��calg&dtypejpublic-key��ˏ-^Bcalg'dtypejpublic-key^M^D^N^Z^@^E^D^C^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 2 ^@�ˏ-�^@�^B�^Ahipa.test^BX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^C��bidX@n<^@�ˏ-^@Q^^�^As�}����K��r�EL��"q��^M�Pث��X^ZFy�֮���^Ny~2�%�Н�J<��^`6*^@�ˏ-^A�<�dtypejpublic-key^E�bup�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 83 �ˏ-�^@�^@�^A�bidX@n<Q^^�^As�}����K��r�EL��"q��^M�Pث��X^ZFy�֮���^Ny~2�ˏ-^@�%�Н�J<��^`6*�<�dtypejpublic-key^BX%�^@�|���Dږ^Qx??�d^Q/N�4�/o�ˏ-^AC���}.�[^@^@^@^@^J^CXG0E^B ^_��8H�i�h�^T�^^^U^Uٜ=^N׊^E�^S�u�^^��^B!^@�����ˏ-^B:�H��^`�e^O�������(�!��ja��H^T^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 3 ^@�ˏ-�^@^F^F�^A^B^B^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 3 �ˏ-�^@Q^@�^A�^A^B^C8^X ^A!X ���^E�����h^Ql�e$��^\��^E^H�4'I�?O��"X ^` �^C1�^I^L�ˏ-^@l��L��1�i��5�I��cRk^J�Z�s^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 3 ^@�ˏ-�^@x^F�^A^B^B^E^C�^A^B^C8^X ^A!X 3�B�1�ˠ^S�^\^Ev�,�^P<Rij��,Q�\���b"X [�^M^J^@�ˏ-^@�G8��������5��Q\^\^U��^E�Q!^FX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A��(�:^L�n*‹^@�ˏ-^A�ƈ�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 79 �ˏ-�^@5^@�^BX0U5�^H*��\�c�OY��K�H�j��hv����դ\��z���T>F^A'0��΂^@^@^@^@
+w 1 ^@�ˏ-�^@�^B�^Ahipa.test^BX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^C��bidX@n<^@�ˏ-^@Q^^�^As�}����K��r�EL��"q��^M�Pث��X^ZFy�֮���^Ny~2�%�Н�J<��^`6*^@�ˏ-^A�<�dtypejpublic-key^E�bup�^FX �d�S�m^O��6�^_��^I��{g{^Qc�Г@M�^G^@�ˏ-^B^H^G^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 227 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 �ˏ-�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 198 �ˏ-�^@�^@�^A�bidX@n<Q^^�^As�}����K��r�EL��"q��^M�Pث��X^ZFy�֮���^Ny~2�ˏ-^@�%�Н�J<��^`6*�<�dtypejpublic-key^BX%�^@�|���Dږ^Qx??�d^Q/N�4�/o�ˏ-^AC���}.�[^E^@^@^@^N^CXH0F^B!^@�Z�^@�^`��O�� �e�^M��Ż�D^K�ڽ�^Vy��*^B!^@�^E.�ˏ-^Bp��^O-�އ4����Pڵ@RuڒS^U�9\���^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
\ No newline at end of file
diff --git a/src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/passkey-mapping.ipa b/src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/passkey-mapping.ipa
new file mode 100644
index 00000000000..0c0a4ff341e
--- /dev/null
+++ b/src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/passkey-mapping.ipa
@@ -0,0 +1 @@
+passkey:SSgOUcGCN5WWyIfxAKkFN2HJ+Ko98UVT+O+P0cFgP0YYAKY2zhbFnjT5ZYOwh6Z1h4/7gZIPVEjF4TY6vmPbHg==,MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHoY7OmDGaK3Q5EVB2LdtP1Gyko6Fz5j5KhLSKy0jKJ47QngRYc6nfzfhnQ2LQpCxbbQcnxnhkNDZugkx9VC1gQ==
diff --git a/src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/umockdev.script.ipa b/src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/umockdev.script.ipa
new file mode 100644
index 00000000000..c8e82d860e1
--- /dev/null
+++ b/src/tests/system/data/test_passkey/test_passkey__su_fallback_to_password/umockdev.script.ipa
@@ -0,0 +1,29 @@
+d 0 /dev/hidraw1
+
+w 3 ^@�����^@^H^A^A^A^A^A^A^A^A^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 2 �����^@^Q^A^A^A^A^A^A^A^ArE�^B^E^D^C^E^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 1 ^@rE�^@^A^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 3 rE�^@�^@�^A�fU2F_V2hFIDO_2_0lFIDO_2_1_PRE^B�kcredProtectkhmac-secrrE�^@et^CP/�W��^SG�^V�Z�� *^D�brk�bup�dplat�iclientPin�ucredentialMrE�^AgmtPreview�^E^Y^D�^F�^B^A^G^H^H^X�^I�cnfccusb^J��calg&dtypejpublic-key�rE�^Bcalg'dtypejpublic-key^M^D^N^Z^@^E^D^C^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 1 ^@rE�^@�^B�^Ahipa.test^BX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^C��bidX@I(^@rE�^@^NQ��7��ȇ�^@�^E7a���=�ES����`?F^X^@�6�^VŞ4�e����u�����^OTH��6:�^@rE�^Ac�^^dtypejpublic-key^E�bup�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 83 rE�^@�^@�^A�bidX@I(^NQ��7��ȇ�^@�^E7a���=�ES����`?F^X^@�6�^VŞ4�e����urE�^@�����^OTH��6:�c�^^dtypejpublic-key^BX%�^@�|���Dږ^Qx??�d^Q/N�4�/orE�^AC���}.�[^@^@^@^@^I^CXF0D^B hm�i�e^UЯ�Z^Hb^\Mu�&����^N��6���ν�^B ,r�^SOrE�^B�-0G]���^W��ִ����"u!��^DU�]�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 4 ^@rE�^@^F^F�^A^B^B^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 2 rE�^@Q^@�^A�^A^B^C8^X ^A!X d^O�^HPûw��7^H-}_��h���X��W8�R^U�h0"X W�Z�1^Z�RrE�^@w8^R.#�=m[4�v�^U<�l�m�9�ġ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 5 ^@rE�^@x^F�^A^B^B^E^C�^A^B^C8^X ^A!X 3�B�1�ˠ^S�^\^Ev�,�^P<Rij��,Q�\���b"X [�^M^J^@rE�^@�G8��������5��Q\^\^U��^E�Q!^FX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A��m(�_"v^XE��^@rE�^A^^�o�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 79 rE�^@5^@�^BX0-s�P�^Q43^Rp�Q�����q�E�m�^Db��[S�k�^M�^K�݌�s�^]��N^@^@^@^@
+w 1 ^@rE�^@�^B�^Ahipa.test^BX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^C��bidX@I(^@rE�^@^NQ��7��ȇ�^@�^E7a���=�ES����`?F^X^@�6�^VŞ4�e����u�����^OTH��6:�^@rE�^Ac�^^dtypejpublic-key^E�bup�^FX ^Z1bĪ��y��|^^\T��o�4�^M$�*X^Z?_�g�^@rE�^B�^G^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 213 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 rE�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 126 rE�^@�^@�^A�bidX@I(^NQ��7��ȇ�^@�^E7a���=�ES����`?F^X^@�6�^VŞ4�e����urE�^@�����^OTH��6:�c�^^dtypejpublic-key^BX%�^@�|���Dږ^Qx??�d^Q/N�4�/orE�^AC���}.�[^E^@^@^@^J^CXH0F^B!^@�L^Z�K�^F^T�8G�1��[^JF�LF�������"^R��^B!^@�frE�^B���p^C��^J��AP���vP�5�/��^E�yv�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
\ No newline at end of file
diff --git a/src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/passkey-mapping.ipa b/src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/passkey-mapping.ipa
new file mode 100644
index 00000000000..a1cce5344d3
--- /dev/null
+++ b/src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/passkey-mapping.ipa
@@ -0,0 +1 @@
+passkey:us0eBiX3rqdGTYS3vKoYcazLJFX5raek9hYSTGmVBq2fkUkjElUiITXtJQofnIPwYAc4D4w5+Sn27EuD/bejoA==,MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENx1bON3YvOlfpOp4UrObEwl4VoKqqahDIM033nBHkm9c7759s3ZbbxlOBRHicrzhIey5Z3THT6jtlMb9mv+Kyg==
diff --git a/src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/umockdev.script.ipa b/src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/umockdev.script.ipa
new file mode 100644
index 00000000000..a76e7072e1b
--- /dev/null
+++ b/src/tests/system/data/test_passkey/test_passkey__su_no_pin_set/umockdev.script.ipa
@@ -0,0 +1,18 @@
+d 0 /dev/hidraw1
+
+w 3 ^@�����^@^H^A^A^A^A^A^A^A^A^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 3 �����^@^Q^A^A^A^A^A^A^A^A���c^B^E^D^C^E^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 1 ^@���c�^@^A^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 3 ���c�^@�^@�^A�fU2F_V2hFIDO_2_0lFIDO_2_1_PRE^B�kcredProtectkhmac-secr���c^@et^CP/�W��^SG�^V�Z�� *^D�brk�bup�dplat�iclientPin�ucredentialM���c^AgmtPreview�^E^Y^D�^F�^B^A^G^H^H^X�^I�cnfccusb^J��calg&dtypejpublic-key����c^Bcalg'dtypejpublic-key^M^D^N^Z^@^E^D^C^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 1 ^@���c�^@�^B�^Ahipa.test^BX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^C��bidX@��^@���c^@^^^F%���FM����^Xq��$U�����^V^RLi�^F���I#^RU"!5�%^J^_���`^G8^O�9�)��K��^@���c^A���dtypejpublic-key^E�bup�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 83 ���c�^@�^@�^A�bidX@��^^^F%���FM����^Xq��$U�����^V^RLi�^F���I#^RU"!5�%^J^_����c^@`^G8^O�9�)��K�����dtypejpublic-key^BX%�^@�|���Dږ^Qx??�d^Q/N�4�/o���c^AC���}.�[^@^@^@^@^K^CXG0E^B!^@�€���^O?\�� ��^M�f�L���@^VP@M^C���B^B 0��Ɣ��c^B0^O�H\^CQ�"^E--�*��e��^P^T��!3^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+w 1 ^@���c�^@�^B�^Ahipa.test^BX ^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^C��bidX@��^@���c^@^^^F%���FM����^Xq��$U�����^V^RLi�^F���I#^RU"!5�%^J^_���`^G8^O�9�)��K��^@���c^A���dtypejpublic-key^E�bup�^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 261 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 287 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 290 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 291 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 288 ���c�^@^A^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
+r 221 ���c�^@�^@�^A�bidX@��^^^F%���FM����^Xq��$U�����^V^RLi�^F���I#^RU"!5�%^J^_����c^@`^G8^O�9�)��K�����dtypejpublic-key^BX%�^@�|���Dږ^Qx??�d^Q/N�4�/o���c^AC���}.�[^A^@^@^@^M^CXF0D^B e�_�r^Y���b�#V�4�j-RF�㬑�^YLܱ}��^B Ag��^R���c^Bh�Q^J��c7�^^^V[xg�0^`������^Hӆ^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
\ No newline at end of file
diff --git a/src/tests/system/tests/test_passkey.py b/src/tests/system/tests/test_passkey.py
index cacaf89db48..82099d02c07 100644
--- a/src/tests/system/tests/test_passkey.py
+++ b/src/tests/system/tests/test_passkey.py
@@ -75,6 +75,7 @@
 from sssd_test_framework.roles.generic import GenericProvider
 from sssd_test_framework.roles.ipa import IPA
 from sssd_test_framework.topology import KnownTopology, KnownTopologyGroup
+from sssd_test_framework.utils.authentication import PasskeyAuthenticationUseCases
 
 
 @mh_fixture()
@@ -740,3 +741,149 @@ def test_passkey__su_with_12_mappings(
         )
         in output
     ), "Get the console message about TGT"
+
+
+@pytest.mark.importance("critical")
+@pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="passkey", ipa="passkey")
+@pytest.mark.ticket(gh=6931)
+def test_passkey__su_no_pin_set(
+    client: Client, ipa: IPA, moduledatadir: str, testdatadir: str, umockdev_ipaotpd_update
+):
+    """
+    :title: Check authentication of user with IPA server when no pin set for the Passkey
+    :setup:
+        1. Add a user with --user-auth-type=passkey in the IPA server
+        2. Modify Passkey configuration to set require user verification during authentication to false
+        3. Setup SSSD client with FIDO and umockdev, start SSSD service
+    :steps:
+         1. Check authentication of the user when no pin set for the Passkey
+         2. Check the TGT of user
+    :expectedresults:
+        1. User authenticates successfully
+        2. Get TGT after authentication of user
+    :customerscenario: False
+    """
+    with open(f"{testdatadir}/passkey-mapping.ipa") as f:
+        ipa.user("user1").add(user_auth_type="passkey").passkey_add(f.read().strip())
+
+    ipa.host.conn.run("ipa passkeyconfig-mod --require-user-verification=False", raise_on_error=False)
+    client.sssd.start(service_user="root")
+
+    rc, _, output, _ = client.auth.su.passkey_with_output(
+        username="user1",
+        device=f"{moduledatadir}/umockdev.device",
+        ioctl=f"{moduledatadir}/umockdev.ioctl",
+        script=f"{testdatadir}/umockdev.script.ipa",
+        command="klist",
+        auth_method=PasskeyAuthenticationUseCases.PASSKEY_NO_PIN_NO_PROMPTS,
+    )
+
+    assert rc == 0, "Authentication failed"
+    assert "Ticket cache" in output, "Failed to get the TGT"
+    assert not (
+        (
+            "No Kerberos TGT granted as the server does not support this method. "
+            "Your single-sign on(SSO) experience will be affected"
+        )
+        in output
+    ), "Got the console message about No Kerberos TGT granted"
+
+
+@pytest.mark.importance("medium")
+@pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="passkey", ipa="passkey")
+@pytest.mark.ticket(gh=6931)
+def test_passkey__prompt_options(
+    client: Client, ipa: IPA, moduledatadir: str, testdatadir: str, umockdev_ipaotpd_update
+):
+    """
+    :title: Check authentication of user with updated prompting options
+    :setup:
+        1. Add a user in the server with passkey mappings
+        2. Add the prompting options to sssd.conf file
+        3. Setup SSSD client with FIDO and umockdev, start SSSD service
+    :steps:
+        1. Check authentication of the user
+        2. Check the updated prompt options
+    :expectedresults:
+        1. User authenticates successfully
+        2. Got the updated prompt options
+    :customerscenario: False
+    """
+    with open(f"{testdatadir}/passkey-mapping.ipa") as f:
+        ipa.user("user1").add(user_auth_type="passkey").passkey_add(f.read().strip())
+
+    client.sssd.section("prompting/passkey")["interactive"] = "True"
+    client.sssd.section("prompting/passkey")["interactive_prompt"] = "Please, insert the passkey and press enter"
+    client.sssd.section("prompting/passkey")["touch"] = "True"
+    client.sssd.section("prompting/passkey")["touch_prompt"] = "Can you touch the passkey"
+    client.sssd.start(service_user="root")
+
+    rc, _, output, _ = client.auth.su.passkey_with_output(
+        username="user1",
+        device=f"{moduledatadir}/umockdev.device",
+        ioctl=f"{moduledatadir}/umockdev.ioctl",
+        script=f"{testdatadir}/umockdev.script.ipa",
+        pin=123456,
+        interactive_prompt="Please, insert the passkey and press enter",
+        touch_prompt="Can you touch the passkey",
+        command="klist",
+        auth_method=PasskeyAuthenticationUseCases.PASSKEY_PIN_AND_PROMPTS,
+    )
+
+    assert rc == 0, "Authentication failed"
+    assert "Ticket cache" in output, "Failed to get the TGT"
+    assert (
+        not (
+            "No Kerberos TGT granted as the server does not support this method."
+            "Your single-sign on(SSO) experience will be affected"
+        )
+        in output
+    ), "Got the console message about No Kerberos TGT granted"
+
+
+@pytest.mark.importance("critical")
+@pytest.mark.topology(KnownTopology.IPA)
+@pytest.mark.builtwith(client="passkey", ipa="passkey")
+@pytest.mark.ticket(gh=7143)
+def test_passkey__su_fallback_to_password(
+    client: Client, ipa: IPA, moduledatadir: str, testdatadir: str, umockdev_ipaotpd_update
+):
+    """
+    :title: Check password authentication of user with IPA server when sssd fall back to password authentication
+    :setup:
+        1. Add a user with --user-auth-type=passkey, password in the IPA server
+        2. Setup SSSD client with FIDO and umockdev, start SSSD service
+    :steps:
+        1. Check authentication of the user with password
+        2. Check the TGT of user
+    :expectedresults:
+        1. User authenticates successfully
+        2. Get TGT after authentication of user
+    :customerscenario: False
+    """
+    with open(f"{testdatadir}/passkey-mapping.ipa") as f:
+        ipa.user("user1").add(user_auth_type=["passkey", "password"]).passkey_add(f.read().strip())
+
+    client.sssd.start(service_user="root")
+
+    rc, _, output, _ = client.auth.su.passkey_with_output(
+        username="user1",
+        device=f"{moduledatadir}/umockdev.device",
+        ioctl=f"{moduledatadir}/umockdev.ioctl",
+        script=f"{testdatadir}/umockdev.script.ipa",
+        pin="\\n",
+        command="klist",
+        auth_method=PasskeyAuthenticationUseCases.PASSKEY_FALLBACK_TO_PASSWORD,
+    )
+
+    assert rc == 0, "Authentication failed"
+    assert "Ticket cache" in output, "Failed to get the TGT"
+    assert (
+        not (
+            "No Kerberos TGT granted as the server does not support this method."
+            " Your single-sign on(SSO) experience will be affected"
+        )
+        in output
+    ), "Got the console message about No Kerberos TGT granted"

From 4a7ab02d893a0e98b72bf711db126abfb4324ee9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20V=C3=A1vra?= <jvavra@redhat.com>
Date: Wed, 2 Oct 2024 10:22:41 +0200
Subject: [PATCH 058/129] Tests: Add missing returncode to test_0004_bz1638295

Reviewed-by: Anuj Borah <aborah@redhat.com>
---
 src/tests/multihost/alltests/test_sssctl_ldap.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tests/multihost/alltests/test_sssctl_ldap.py b/src/tests/multihost/alltests/test_sssctl_ldap.py
index 0740c0ea0ae..72fa11668c4 100644
--- a/src/tests/multihost/alltests/test_sssctl_ldap.py
+++ b/src/tests/multihost/alltests/test_sssctl_ldap.py
@@ -125,7 +125,7 @@ def test_0004_bz1638295(self, multihost,
         tools.sssd_conf("ifp", domain_params)
         multihost.client[0].service_sssd('start')
         cmd_id = multihost.client[0].run_command("id user5000", raiseonerr=False)
-        if cmd_id != 0:
+        if cmd_id.returncode != 0:
             multihost.client[0].run_command("useradd -u 5000 user5000")
             multihost.client[0].run_command("passwd --stdin user5000", stdin_text='Secret123')
 

From cbe3b03472a678b9a8470b3e3a0e08655808e06d Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 15 Oct 2024 18:47:59 +0200
Subject: [PATCH 059/129] When using SPDX expression the booleans must be in
 all caps.

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 contrib/sssd.spec.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index bd57f830461..b5ed967ca9d 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -509,7 +509,7 @@ Provides library that simplifies D-Bus API for the SSSD InfoPipe responder.
 
 %package winbind-idmap
 Summary: SSSD's idmap_sss Backend for Winbind
-License: GPL-3.0-or-later and LGPL-3.0-or-later
+License: GPL-3.0-or-later AND LGPL-3.0-or-later
 Requires: libsss_nss_idmap = %{version}-%{release}
 Requires: libsss_idmap = %{version}-%{release}
 Conflicts: sssd-common < %{version}-%{release}

From b928dbe1fcb6cf4b7acbd97d3df9514d5c554953 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 15 Oct 2024 12:22:36 +0200
Subject: [PATCH 060/129] Get rid of on-house MIN/MAX definitions

This matches approach already taken in sss_client/idmap/sss_nss_ex.c

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/ldb_modules/memberof.c    |  4 ----
 src/util/safe-format-string.c | 10 ++--------
 src/util/util.h               |  9 +--------
 3 files changed, 3 insertions(+), 20 deletions(-)

diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c
index 21a175cb353..53bf60e75c3 100644
--- a/src/ldb_modules/memberof.c
+++ b/src/ldb_modules/memberof.c
@@ -33,10 +33,6 @@
 #define DB_CACHE_EXPIRE "dataExpireTimestamp"
 #define DB_OC "objectCategory"
 
-#ifndef MAX
-#define MAX(a,b) (((a) > (b)) ? (a) : (b))
-#endif
-
 struct mbof_val_array {
     struct ldb_val *vals;
     int num;
diff --git a/src/util/safe-format-string.c b/src/util/safe-format-string.c
index 11532d42e79..2b28a802849 100644
--- a/src/util/safe-format-string.c
+++ b/src/util/safe-format-string.c
@@ -33,19 +33,13 @@
 
 #include "config.h"
 
-#include "safe-format-string.h"
-
+#include <sys/param.h> /* for MIN() */
 #include <errno.h>
 #include <stdarg.h>
 #include <string.h>
 
-#ifndef MIN
-#define MIN(a, b)  (((a) < (b)) ? (a) : (b))
-#endif
+#include "safe-format-string.h"
 
-#ifndef MAX
-#define MAX(a, b)  (((a) > (b)) ? (a) : (b))
-#endif
 
 static void
 safe_padding (int count,
diff --git a/src/util/util.h b/src/util/util.h
index a25b55ef396..8674c6c9dbd 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -34,6 +34,7 @@
 #include <limits.h>
 #include <sys/un.h>
 #include <sys/capability.h>
+#include <sys/param.h> /* for MIN()/MAX() */
 
 #include <talloc.h>
 #include <tevent.h>
@@ -79,14 +80,6 @@
 #define NULL 0
 #endif
 
-#ifndef MIN
-#define MIN(a, b)  (((a) < (b)) ? (a) : (b))
-#endif
-
-#ifndef MAX
-#define MAX(a, b)  (((a) > (b)) ? (a) : (b))
-#endif
-
 #ifndef ALLPERMS
 #define ALLPERMS (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO)/* 07777 */
 #endif

From ed666e9fa8d5be66700d69186c2edb350df5816f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20V=C3=A1vra?= <jvavra@redhat.com>
Date: Wed, 16 Oct 2024 15:39:19 +0200
Subject: [PATCH 061/129] tests: Unify packages available on client for ipa
 suites

This is needed to detect sssd NVR for idmci.

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 src/tests/multihost/ipa/conftest.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/tests/multihost/ipa/conftest.py b/src/tests/multihost/ipa/conftest.py
index f6d5d5b1a34..78bf50b1d41 100644
--- a/src/tests/multihost/ipa/conftest.py
+++ b/src/tests/multihost/ipa/conftest.py
@@ -10,7 +10,6 @@
 from sssd.testlib.common.utils import sssdTools
 from sssd.testlib.ipa.utils import ipaTools
 from sssd.testlib.common.utils import ADOperations
-from sssd.testlib.common.paths import SSSD_DEFAULT_CONF
 
 
 pytest_plugins = (
@@ -431,6 +430,8 @@ def setup_ipa_client(session_multihost, request):
     server_hostname = session_multihost.master[0].sys_hostname
     ipa_client = ipaTools(session_multihost.client[0])
     ipa_server = ipaTools(session_multihost.master[0])
+    client = sssdTools(session_multihost.client[0])
+    client.client_install_pkgs()
     ipa_client.install_common_pkgs()
     ipa_server.install_common_pkgs()
     ipa_client_ip = session_multihost.client[0].ip

From a2e91d20fc876f7c976623ecd6f6fb282c2d406c Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Fri, 18 Oct 2024 12:37:01 +0200
Subject: [PATCH 062/129] build: remove superfluous WITH_IFP leftover

```
$ autoreconf && configure
...
./configure: line 18674: WITH_IFP: command not found
```

Fixes: 2.10.0-beta2-63-ge5140ab08

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
---
 configure.ac | 1 -
 1 file changed, 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index 380c16ba80a..b5222ae973f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -187,7 +187,6 @@ WITH_SUBID_LIB_PATH
 WITH_PASSKEY
 WITH_SSH
 WITH_SSH_KNOWN_HOSTS_PROXY
-WITH_IFP
 WITH_LIBSIFP
 WITH_SYSLOG
 WITH_SAMBA

From 510130e844785b5ab7cb8415b1eb326d85360feb Mon Sep 17 00:00:00 2001
From: Scott Poore <spoore@redhat.com>
Date: Wed, 16 Oct 2024 14:28:52 -0500
Subject: [PATCH 063/129] man: sssd.conf update defaults for certmap maprule

The sssd.conf man page lists that the maprule RULE_NAME is used to match
a username.  However, this is conditional when built with the files
provider.  This change states that unconditionally in the maprule
defaults and states that it applies to both the files and proxy
providers.

Signed-off-by: Scott Poore <spoore@redhat.com>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/man/sssd.conf.5.xml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 860ab94cf1e..a074cc674af 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -4416,10 +4416,12 @@ ldap_user_extra_attrs = phone:telephoneNumber
                                 <quote>ldap</quote>, <quote>AD</quote> or
                                 <quote>ipa</quote>.</para>
                             </listitem>
-                            <listitem condition="with_files_provider">
-                                <para>The RULE_NAME for the <quote>files</quote>
-                                provider which tries to find a user with the
-                                same name.</para>
+                            <listitem>
+                                <para>If maprule is not set and provider is
+                                <quote>proxy</quote><phrase condition="with_files_provider">
+                                &nbsp;or <quote>files</quote></phrase>,
+                                the RULE_NAME name is assumed to be the name of
+                                the matching user.</para>
                             </listitem>
                         </itemizedlist>
                     </para>

From 2b7915dd84a6b8c3ee26e45357283677fe22f2cb Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Wed, 16 Oct 2024 09:55:50 +0200
Subject: [PATCH 064/129] sssd: always print path when config object is
 rejected

Observed:

```
Oct 16 09:44:04 a4 sssd[28717]: [sssd] [sss_ini_read_sssd_conf] (0x0020): Permission check on config file failed.
Oct 16 09:44:04 a4 sssd[28717]: Can't read config: 'File ownership and permissions check failed'
Oct 16 09:44:04 a4 sssd[28717]: Failed to read configuration: 'File ownership and permissions check failed'
```

Expected:

_Well yes, but **which one**_!?

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
---
 src/util/sss_ini.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 7f9824d8890..2a611eb8c0d 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -888,7 +888,7 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
     ret = sss_ini_open(self, config_file, "[sssd]\n");
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE,
-              "The sss_ini_open failed %s: %d\n",
+              "sss_ini_open on %s failed: %d\n",
               config_file,
               ret);
         return ERR_INI_OPEN_FAILED;
@@ -898,26 +898,28 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
         ret = sss_ini_access_check(self);
         if (ret != EOK) {
             DEBUG(SSSDBG_CRIT_FAILURE,
-                  "Permission check on config file failed.\n");
+                  "Permission check on config file %s failed: %d\n",
+                  config_file, ret);
             return ERR_INI_INVALID_PERMISSION;
         }
     } else {
         DEBUG(SSSDBG_CONF_SETTINGS,
-              "File %1$s does not exist.\n",
-              (config_file ? config_file : "NULL"));
+              "File %s does not exist.\n", config_file);
     }
 
     ret = sss_ini_parse(self);
     if (ret != EOK) {
         sss_ini_config_print_errors(self->error_list);
-        DEBUG(SSSDBG_FATAL_FAILURE, "Failed to parse configuration.\n");
+        DEBUG(SSSDBG_FATAL_FAILURE, "Failed to parse configuration file %s: %d\n",
+              config_file, ret);
         return ERR_INI_PARSE_FAILED;
     }
 
     ret = sss_ini_add_snippets(self, config_dir);
     if (ret != EOK) {
         DEBUG(SSSDBG_FATAL_FAILURE,
-              "Error while reading configuration directory.\n");
+              "Error while reading configuration directory %s: %d\n",
+              config_dir, ret);
         return ERR_INI_ADD_SNIPPETS_FAILED;
     }
 

From d004e7b4b977da3dd9f1d3de910c28c093a6fb26 Mon Sep 17 00:00:00 2001
From: santeri3700 <santeri.pikarinen@gmail.com>
Date: Tue, 15 Oct 2024 20:13:20 +0300
Subject: [PATCH 065/129] ad: honor ad_use_ldaps setting with
 ad_machine_pw_renewal

The value of ad_use_ldaps was not passed as `--use-ldaps`
argument to the adcli update command which handles
the automatic renewal of AD machine account password.

Resolves: https://github.com/SSSD/sssd/issues/7642

Signed-off-by: santeri3700 <santeri.pikarinen@gmail.com>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/ad/ad_machine_pw_renewal.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/providers/ad/ad_machine_pw_renewal.c b/src/providers/ad/ad_machine_pw_renewal.c
index 56b64a2a955..2e54e9bff0d 100644
--- a/src/providers/ad/ad_machine_pw_renewal.c
+++ b/src/providers/ad/ad_machine_pw_renewal.c
@@ -39,6 +39,7 @@ struct renewal_data {
 static errno_t get_adcli_extra_args(const char *ad_domain,
                                     const char *ad_hostname,
                                     const char *ad_keytab,
+                                    bool ad_use_ldaps,
                                     size_t pw_lifetime_in_days,
                                     bool add_samba_data,
                                     size_t period,
@@ -59,7 +60,7 @@ static errno_t get_adcli_extra_args(const char *ad_domain,
         return ENOMEM;
     }
 
-    args = talloc_array(renewal_data, const char *, 9);
+    args = talloc_array(renewal_data, const char *, 10);
     if (args == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, "talloc_array failed.\n");
         return ENOMEM;
@@ -79,6 +80,9 @@ static errno_t get_adcli_extra_args(const char *ad_domain,
         args[c++] = talloc_asprintf(args, "--host-keytab=%s", ad_keytab);
     }
     args[c++] = talloc_asprintf(args, "--domain=%s", ad_domain);
+    if (ad_use_ldaps) {
+        args[c++] = talloc_strdup(args, "--use-ldaps");
+    }
     if (DEBUG_IS_SET(SSSDBG_TRACE_LIBS)) {
         args[c++] = talloc_strdup(args, "--verbose");
     }
@@ -390,6 +394,7 @@ errno_t ad_machine_account_password_renewal_init(struct be_ctx *be_ctx,
                    dp_opt_get_cstring(ad_opts->basic, AD_HOSTNAME),
                    dp_opt_get_cstring(ad_opts->id_ctx->sdap_id_ctx->opts->basic,
                                       SDAP_KRB5_KEYTAB),
+                   dp_opt_get_bool(ad_opts->basic, AD_USE_LDAPS),
                    lifetime,
                    dp_opt_get_bool(ad_opts->basic,
                                    AD_UPDATE_SAMBA_MACHINE_ACCOUNT_PASSWORD),

From 6b2219015f6b9ea547e7a2a4ff57d0c06a66f47d Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Tue, 22 Oct 2024 14:30:16 -0400
Subject: [PATCH 066/129] SPEC: require systemtap-sdt-dtrace on ELN

ELN (the future RHEL 11) tracks rawhide and therefore also includes a systemtap with a separate dtrace subpackage.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 contrib/sssd.spec.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index b5ed967ca9d..4fbacb959d6 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -175,7 +175,7 @@ BuildRequires: softhsm >= 2.1.0
 BuildRequires: bc
 BuildRequires: systemd-devel
 BuildRequires: systemtap-sdt-devel
-%if 0%{?fedora} >= 41
+%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11
 BuildRequires: systemtap-sdt-dtrace
 %endif
 BuildRequires: uid_wrapper

From a822206c7859b5f39af2b2ea1b117850a0589e3c Mon Sep 17 00:00:00 2001
From: Tomas Halman <thalman@redhat.com>
Date: Mon, 21 Oct 2024 16:31:38 +0200
Subject: [PATCH 067/129] Missing 'dns_update_per_family' option

This update fixes missing 'dns_update_per_family' option in python code
and config files.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
---
 src/config/SSSDConfig/sssdoptions.py | 2 ++
 src/config/SSSDConfigTest.py         | 2 ++
 src/config/cfg_rules.ini             | 1 +
 src/config/etc/sssd.api.conf         | 1 +
 4 files changed, 6 insertions(+)

diff --git a/src/config/SSSDConfig/sssdoptions.py b/src/config/SSSDConfig/sssdoptions.py
index affe2e52918..7eed403e4bd 100644
--- a/src/config/SSSDConfig/sssdoptions.py
+++ b/src/config/SSSDConfig/sssdoptions.py
@@ -197,6 +197,8 @@ def __init__(self):
         'refresh_expired_interval': _('How often should expired entries be refreshed in background'),
         'refresh_expired_interval_offset': _("Maximum period deviation when refreshing expired entries in background"),
         'dyndns_update': _("Whether to automatically update the client's DNS entry"),
+        'dyndns_update_per_family': _('Whether DNS update of A and AAAA record should be performed '
+                                      'in one update or in two separate updates'),
         'dyndns_ttl': _("The TTL to apply to the client's DNS entry after updating it"),
         'dyndns_iface': _("The interface whose IP should be used for dynamic DNS updates"),
         'dyndns_refresh_interval': _("How often to periodically update the client's DNS entry"),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index bc398cc8b8e..1ce4637eda7 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -558,6 +558,7 @@ def testListOptions(self):
             'dns_discovery_domain',
             'failover_primary_timeout',
             'dyndns_update',
+            'dyndns_update_per_family',
             'dyndns_ttl',
             'dyndns_iface',
             'dyndns_refresh_interval',
@@ -919,6 +920,7 @@ def testRemoveProvider(self):
             'dns_discovery_domain',
             'failover_primary_timeout',
             'dyndns_update',
+            'dyndns_update_per_family',
             'dyndns_ttl',
             'dyndns_iface',
             'dyndns_refresh_interval',
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index b33cd876b95..950eae630fb 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -433,6 +433,7 @@ option = refresh_expired_interval_offset
 
 # Dynamic DNS updates
 option = dyndns_update
+option = dyndns_update_per_family
 option = dyndns_ttl
 option = dyndns_iface
 option = dyndns_refresh_interval
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index b5d42afbb1e..4377a1fc571 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -207,6 +207,7 @@ refresh_expired_interval_offset = int, None, false
 
 # Dynamic DNS updates
 dyndns_update = bool, None, false
+dyndns_update_per_family = bool, None, false
 dyndns_ttl = int, None, false
 dyndns_iface = str, None, false
 dyndns_refresh_interval = int, None, false

From 42d1837a87cddfcbeb111cb7a0410e53e1b46cf7 Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Fri, 18 Oct 2024 12:59:43 +0200
Subject: [PATCH 068/129] build: unbreak detection for x400Address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Observed:

```
./configure CFLAGS="-O0 -D_FORTIFY_SOURCE=3"
…
checking whether OpenSSL's x400Address is ASN1_STRING... no
configure: WARNING: OpenSSL's x400Address is not of ASN1_STRING type
```

Expected:

```
checking whether OpenSSL's x400Address is ASN1_STRING... yes
```

Relying on warnings alone is terrible; rewrite the C code to provoke compile
error in all cases. [N.B.: I just noticed that the use of the subtraction
operator is conveniently portable, and one need not use typeof(), which is
merely a language extension prior to C23.]

Fixes: 2.8.0-164-gced32c44e

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/external/crypto.m4 | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/external/crypto.m4 b/src/external/crypto.m4
index 284d15b269d..323c69da775 100644
--- a/src/external/crypto.m4
+++ b/src/external/crypto.m4
@@ -5,8 +5,6 @@ AC_DEFUN([AM_CHECK_LIBCRYPTO],
 ])
 
 AC_MSG_CHECKING([whether OpenSSL's x400Address is ASN1_STRING])
-SAVE_CFLAGS=$CFLAGS
-CFLAGS="$CFLAGS -Werror -Wall -Wextra"
 AC_COMPILE_IFELSE(
                   [AC_LANG_SOURCE([
                       #include <openssl/x509v3.h>
@@ -14,8 +12,9 @@ AC_COMPILE_IFELSE(
                       int main(void)
                       {
                           GENERAL_NAME gn = { 0 };
-
-                          return ASN1_STRING_length(gn.d.x400Address);
+                          /* If the types are different, the compiler will error out. */
+                          gn.d.x400Address - (ASN1_STRING *)0;
+                          return 0;
                       }
                   ])],
                   [
@@ -27,5 +26,3 @@ AC_COMPILE_IFELSE(
                       AC_MSG_RESULT([no])
                       AC_MSG_WARN([OpenSSL's x400Address is not of ASN1_STRING type])
                   ])
-
-CFLAGS=$SAVE_CFLAGS

From b84ced06c14cd1226f830c6de28ef552f9118385 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 17 Oct 2024 17:52:02 +0200
Subject: [PATCH 069/129] DEBUG: add 'debug_backtrace_enable' getter

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/util/debug.h           | 3 ++-
 src/util/debug_backtrace.c | 8 +++++++-
 src/util/server.c          | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/util/debug.h b/src/util/debug.h
index ca7228a3e91..2b4bf851075 100644
--- a/src/util/debug.h
+++ b/src/util/debug.h
@@ -68,7 +68,8 @@ extern const char *debug_log_file;   /* only file name, excluding path */
     DEBUG_INIT(dbg_lvl, sss_logger_str[STDERR_LOGGER]); \
 } while (0)
 
-void sss_debug_backtrace_enable(bool enable);
+void sss_set_debug_backtrace_enable(bool enable);
+bool sss_get_debug_backtrace_enable(void);
 
 /* debug_convert_old_level() converts "old" style decimal notation
  * to bitmask composed of SSSDBG_*
diff --git a/src/util/debug_backtrace.c b/src/util/debug_backtrace.c
index e376f815b8f..93453822bd9 100644
--- a/src/util/debug_backtrace.c
+++ b/src/util/debug_backtrace.c
@@ -93,12 +93,18 @@ void sss_debug_backtrace_init(void)
 }
 
 
-void sss_debug_backtrace_enable(bool enable)
+void sss_set_debug_backtrace_enable(bool enable)
 {
     _bt.enabled = enable;
 }
 
 
+bool sss_get_debug_backtrace_enable(void)
+{
+    return _bt.enabled;
+}
+
+
 void sss_debug_backtrace_vprintf(int level, const char *format, va_list ap)
 {
     va_list ap_copy;
diff --git a/src/util/server.c b/src/util/server.c
index 55146b0e783..8a01126d2ae 100644
--- a/src/util/server.c
+++ b/src/util/server.c
@@ -693,7 +693,7 @@ int server_setup(const char *name, bool is_responder,
               CONFDB_SERVICE_DEBUG_BACKTRACE_ENABLED, ret, strerror(ret));
         return ret;
     }
-    sss_debug_backtrace_enable(backtrace_enabled);
+    sss_set_debug_backtrace_enable(backtrace_enabled);
 
     /* before opening the log file set up log rotation */
     lctx = talloc_zero(ctx, struct logrotate_ctx);

From 2300abbaa148293189ef037e13db37e3d40b3123 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 17 Oct 2024 18:32:46 +0200
Subject: [PATCH 070/129] UTILS: simplify / comment a bit better

`prepare_child_argv()`

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/util/child_common.c | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/src/util/child_common.c b/src/util/child_common.c
index 1dbf95b7a7e..76e5d6a7481 100644
--- a/src/util/child_common.c
+++ b/src/util/child_common.c
@@ -720,35 +720,28 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
                                   bool extra_args_only,
                                   char ***_argv)
 {
-    /*
-     * program name, debug_level, debug_timestamps,
-     * debug_microseconds, PR_SET_DUMPABLE and NULL
-     */
-    uint_t argc = 6;
+    uint_t argc;
     char ** argv = NULL;
     errno_t ret = EINVAL;
     size_t i;
 
+    /* basic args */
     if (extra_args_only) {
-        argc = 2; /* program name and NULL */
-    }
-
-    /* Save the current state in case an interrupt changes it */
-    bool child_debug_timestamps = debug_timestamps;
-    bool child_debug_microseconds = debug_microseconds;
-
-    if (!extra_args_only) {
-        argc++;
+        /* program name and NULL */
+        argc = 2;
+    } else {
+        /* program name, dumpable,
+         * debug-microseconds, debug-timestamps,
+         * logger or debug-fd,
+         * debug-level and NULL
+         */
+        argc = 7;
     }
 
     if (extra_argv) {
         for (i = 0; extra_argv[i]; i++) argc++;
     }
 
-    /*
-     * program name, debug_level, debug_timestamps,
-     * debug_microseconds and NULL
-     */
     argv  = talloc_array(mem_ctx, char *, argc);
     if (argv == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, "talloc_array failed.\n");
@@ -793,14 +786,14 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
         }
 
         argv[--argc] = talloc_asprintf(argv, "--debug-timestamps=%d",
-                                       child_debug_timestamps);
+                                       debug_timestamps);
         if (argv[argc] == NULL) {
             ret = ENOMEM;
             goto fail;
         }
 
         argv[--argc] = talloc_asprintf(argv, "--debug-microseconds=%d",
-                                           child_debug_microseconds);
+                                       debug_microseconds);
         if (argv[argc] == NULL) {
             ret = ENOMEM;
             goto fail;
@@ -821,6 +814,7 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
     }
 
     if (argc != 0) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Bug: unprocessed args\n");
         ret = EINVAL;
         goto fail;
     }

From 88b55de2805bea63ed384800ff2681374b6d06b7 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 17 Oct 2024 19:22:05 +0200
Subject: [PATCH 071/129] DEBUG: propagate debug_backtrace_enabled to child
 processes

Resolves: https://github.com/SSSD/sssd/issues/7510

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/oidc_child/oidc_child.c              |  6 ++++++
 src/p11_child/p11_child_common.c         |  3 +++
 src/passkey_child/passkey_child_common.c |  4 ++++
 src/providers/ad/ad_gpo_child.c          |  4 ++++
 src/providers/ipa/selinux_child.c        |  4 ++++
 src/providers/krb5/krb5_child.c          |  4 ++++
 src/providers/ldap/ldap_child.c          |  4 ++++
 src/tests/cmocka/dummy_child.c           |  5 +++--
 src/util/child_common.c                  | 11 +++++++++--
 9 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/src/oidc_child/oidc_child.c b/src/oidc_child/oidc_child.c
index 7758cdc2508..e75a23c6d67 100644
--- a/src/oidc_child/oidc_child.c
+++ b/src/oidc_child/oidc_child.c
@@ -253,6 +253,7 @@ static struct devicecode_ctx *get_dc_ctx(TALLOC_CTX *mem_ctx,
 
 struct cli_opts {
     const char *opt_logger;
+    int backtrace;
     const char *issuer_url;
     const char *client_id;
     const char *device_auth_endpoint;
@@ -274,6 +275,7 @@ static int parse_cli(int argc, const char *argv[], struct cli_opts *opts)
     poptContext pc;
     int opt;
     errno_t ret;
+    int backtrace = 1;
     int debug_fd = -1;
     const char *opt_logger = NULL;
     bool print_usage = true;
@@ -281,6 +283,8 @@ static int parse_cli(int argc, const char *argv[], struct cli_opts *opts)
     struct poptOption long_options[] = {
         POPT_AUTOHELP
         SSSD_DEBUG_OPTS
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0,
+         _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         {"get-device-code", 0, POPT_ARG_NONE, NULL, 'a',
@@ -398,6 +402,7 @@ static int parse_cli(int argc, const char *argv[], struct cli_opts *opts)
     }
 
     opts->opt_logger = opt_logger;
+    opts->backtrace = backtrace;
 
     if (debug_fd != -1) {
         opts->opt_logger = sss_logger_str[FILES_LOGGER];
@@ -488,6 +493,7 @@ int main(int argc, const char *argv[])
     }
 
     DEBUG_INIT(debug_level, opts.opt_logger);
+    sss_set_debug_backtrace_enable((opts.backtrace == 0) ? false : true);
 
     DEBUG(SSSDBG_TRACE_FUNC, "oidc_child started.\n");
 
diff --git a/src/p11_child/p11_child_common.c b/src/p11_child/p11_child_common.c
index 5eab9b063d4..583c88ac54b 100644
--- a/src/p11_child/p11_child_common.c
+++ b/src/p11_child/p11_child_common.c
@@ -148,6 +148,7 @@ int main(int argc, const char *argv[])
     int opt;
     poptContext pc;
     int dumpable = 1;
+    int backtrace = 1;
     int debug_fd = -1;
     const char *opt_logger = NULL;
     errno_t ret = 0;
@@ -173,6 +174,7 @@ int main(int argc, const char *argv[])
         SSSD_DEBUG_OPTS
         {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
          _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0, _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         SSSD_LOGGER_OPTS
@@ -328,6 +330,7 @@ int main(int argc, const char *argv[])
     sss_chain_id_set((uint64_t)chain_id);
 
     DEBUG_INIT(debug_level, opt_logger);
+    sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
     DEBUG(SSSDBG_TRACE_FUNC, "p11_child started.\n");
 
diff --git a/src/passkey_child/passkey_child_common.c b/src/passkey_child/passkey_child_common.c
index 000a7ee34d7..9e71631a798 100644
--- a/src/passkey_child/passkey_child_common.c
+++ b/src/passkey_child/passkey_child_common.c
@@ -129,6 +129,7 @@ parse_arguments(TALLOC_CTX *mem_ctx, int argc, const char *argv[],
 {
     int opt;
     int dumpable = 1;
+    int backtrace = 1;
     int debug_fd = -1;
     char *user_verification = NULL;
     char *public_keys = NULL;
@@ -163,6 +164,8 @@ parse_arguments(TALLOC_CTX *mem_ctx, int argc, const char *argv[],
         SSSD_DEBUG_OPTS
         {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
          _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0,
+         _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         SSSD_LOGGER_OPTS
@@ -332,6 +335,7 @@ parse_arguments(TALLOC_CTX *mem_ctx, int argc, const char *argv[],
     }
 
     DEBUG_INIT(debug_level, opt_logger);
+    sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
     ret = EOK;
 
diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c
index a4f845625a3..27691f9c19d 100644
--- a/src/providers/ad/ad_gpo_child.c
+++ b/src/providers/ad/ad_gpo_child.c
@@ -660,6 +660,7 @@ main(int argc, const char *argv[])
     int opt;
     poptContext pc;
     int dumpable = 1;
+    int backtrace = 1;
     int debug_fd = -1;
     long chain_id = 0;
     const char *opt_logger = NULL;
@@ -678,6 +679,8 @@ main(int argc, const char *argv[])
         SSSD_DEBUG_OPTS
         {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
          _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0,
+         _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         {"chain-id", 0, POPT_ARG_LONG, &chain_id,
@@ -723,6 +726,7 @@ main(int argc, const char *argv[])
     sss_chain_id_set((uint64_t)chain_id);
 
     DEBUG_INIT(debug_level, opt_logger);
+    sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
     DEBUG(SSSDBG_TRACE_FUNC, "gpo_child started.\n");
 
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
index 063bea44d21..8a968a27570 100644
--- a/src/providers/ipa/selinux_child.c
+++ b/src/providers/ipa/selinux_child.c
@@ -209,6 +209,7 @@ int main(int argc, const char *argv[])
     poptContext pc;
     int debug_fd = -1;
     int dumpable = 1;
+    int backtrace = 1;
     errno_t ret;
     TALLOC_CTX *main_ctx = NULL;
     uint8_t *buf = NULL;
@@ -227,6 +228,8 @@ int main(int argc, const char *argv[])
         SSSD_DEBUG_OPTS
         {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
          _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0,
+         _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         {"chain-id", 0, POPT_ARG_LONG, &chain_id,
@@ -272,6 +275,7 @@ int main(int argc, const char *argv[])
     sss_chain_id_set((uint64_t)chain_id);
 
     DEBUG_INIT(debug_level, opt_logger);
+    sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
     DEBUG(SSSDBG_TRACE_FUNC, "selinux_child started.\n");
     DEBUG(SSSDBG_TRACE_INTERNAL,
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 3f4fa73f3d4..8918fdff1d4 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -4126,6 +4126,7 @@ int main(int argc, const char *argv[])
     int opt;
     poptContext pc;
     int dumpable = 1;
+    int backtrace = 1;
     int debug_fd = -1;
     const char *opt_logger = NULL;
     errno_t ret;
@@ -4143,6 +4144,8 @@ int main(int argc, const char *argv[])
         SSSD_DEBUG_OPTS
         {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
          _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0,
+         _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         SSSD_LOGGER_OPTS
@@ -4232,6 +4235,7 @@ int main(int argc, const char *argv[])
     sss_chain_id_set((uint64_t)chain_id);
 
     DEBUG_INIT(debug_level, opt_logger);
+    sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
     DEBUG(SSSDBG_CONF_SETTINGS,
          "Starting under uid=%"SPRIuid" (euid=%"SPRIuid") : "
diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index 26528f4c1c3..5fdf47d20f2 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -976,6 +976,7 @@ int main(int argc, const char *argv[])
     int ret;
     int opt;
     int dumpable = 1;
+    int backtrace = 1;
     int debug_fd = -1;
     const char *opt_logger = NULL;
     poptContext pc;
@@ -992,6 +993,8 @@ int main(int argc, const char *argv[])
         SSSD_DEBUG_OPTS
         {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
          _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0,
+         _("Enable debug backtrace"), NULL },
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         SSSD_LOGGER_OPTS
@@ -1033,6 +1036,7 @@ int main(int argc, const char *argv[])
     }
 
     DEBUG_INIT(debug_level, opt_logger);
+    sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
     BlockSignals(false, SIGTERM);
     CatchSignal(SIGTERM, sig_term_handler);
diff --git a/src/tests/cmocka/dummy_child.c b/src/tests/cmocka/dummy_child.c
index 407588cccf7..1cd6026f429 100644
--- a/src/tests/cmocka/dummy_child.c
+++ b/src/tests/cmocka/dummy_child.c
@@ -41,6 +41,7 @@ int main(int argc, const char *argv[])
     uint8_t buf[IN_BUF_SIZE];
     const char *action = NULL;
     int dumpable;
+    int backtrace;
     const char *guitar;
     const char *drums;
     int timestamp_opt;
@@ -49,8 +50,8 @@ int main(int argc, const char *argv[])
         POPT_AUTOHELP
         SSSD_DEBUG_OPTS
         SSSD_LOGGER_OPTS
-        {"dumpable", 0, POPT_ARG_INT, &dumpable, 0,
-         _("Allow core dumps"), NULL },
+        {"dumpable", 0, POPT_ARG_INT, &dumpable, 0, _("Allow core dumps"), NULL },
+        {"backtrace", 0, POPT_ARG_INT, &backtrace, 0, _("Enable debug backtrace"), NULL },
         {"guitar", 0, POPT_ARG_STRING, &guitar, 0, _("Who plays guitar"), NULL },
         {"drums", 0, POPT_ARG_STRING, &drums, 0, _("Who plays drums"), NULL },
         POPT_TABLEEND
diff --git a/src/util/child_common.c b/src/util/child_common.c
index 76e5d6a7481..2633863396c 100644
--- a/src/util/child_common.c
+++ b/src/util/child_common.c
@@ -733,9 +733,9 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
         /* program name, dumpable,
          * debug-microseconds, debug-timestamps,
          * logger or debug-fd,
-         * debug-level and NULL
+         * debug-level, backtrace and NULL
          */
-        argc = 7;
+        argc = 8;
     }
 
     if (extra_argv) {
@@ -769,6 +769,13 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
             goto fail;
         }
 
+        argv[--argc] = talloc_asprintf(argv, "--backtrace=%d",
+                                       sss_get_debug_backtrace_enable() ? 1 : 0);
+        if (argv[argc] == NULL) {
+            ret = ENOMEM;
+            goto fail;
+        }
+
         if (sss_logger == FILES_LOGGER) {
             argv[--argc] = talloc_asprintf(argv, "--debug-fd=%d",
                                            child_debug_fd);

From 8cdebfcfea58a0a4cb6d1a62b05ce843cde832a2 Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Fri, 18 Oct 2024 12:46:28 +0200
Subject: [PATCH 072/129] build: stop overriding CFLAGS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CFLAGS is reserved for the user. configure must finish in an
idempotent state and not touch it, pursuant to automake.info §3.6
"Variables reserved for the user".

Observed:

```
$ ./configure && make CFLAGS=-O1
…
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -Wall -I..
-I./src/sss_client -I./src -I. -I/usr/include/samba-4.0
-I/usr/include/dbus-1.0 -I/usr/lib64/dbus-1.0/include
-I/usr/include/libnl3 -DLIBDIR=\"/usr/local/lib\"
-DVARDIR=\"/usr/local/var\" -DRUNDIR=\"/usr/local/var/run\"
-DSSS_STATEDIR=\"/usr/local/var/lib/sss\"
-DSYSCONFDIR=\"/usr/local/etc\" -DSHLIBEXT=\"\"
-DSSSDDATADIR=\"/usr/local/share/sssd\"
-DSSSD_LIBEXEC_PATH=\"/usr/local/libexec/sssd\"
-DSSSD_CONF_DIR=\"/usr/local/etc/sssd\"
-DSSS_NSS_MCACHE_DIR=\"/usr/local/var/lib/sss/mc\"
-DSSS_NSS_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/pam\"
-DSSS_PAC_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/pac\"
-DSSS_SUDO_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/autofs\"
-DSSS_SSH_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/ssh\"
-DLOCALEDIR=\"/usr/local/share/locale\"
-DBASE_FILE_STEM=\"libsss_util_la-sysdb_ops\" -Wall -Wshadow
-Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Wundef -Werror-implicit-function-declaration
-Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99
-O1 -MT src/db/libsss_util_la-sysdb_ops.lo -MD -MP -MF
src/db/.deps/libsss_util_la-sysdb_ops.Tpo -c src/db/sysdb_ops.c -fPIC
-DPIC -o src/db/.libs/libsss_util_la-sysdb_ops.o
```

Expected:

```
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -Wall -I..
-I./src/sss_client -I./src -I. -I/usr/include/samba-4.0
-I/usr/include/dbus-1.0 -I/usr/lib64/dbus-1.0/include
-I/usr/include/libnl3 -DLIBDIR=\"/usr/local/lib\"
-DVARDIR=\"/usr/local/var\" -DRUNDIR=\"/usr/local/var/run\"
-DSSS_STATEDIR=\"/usr/local/var/lib/sss\"
-DSYSCONFDIR=\"/usr/local/etc\" -DSHLIBEXT=\"\"
-DSSSDDATADIR=\"/usr/local/share/sssd\"
-DSSSD_LIBEXEC_PATH=\"/usr/local/libexec/sssd\"
-DSSSD_CONF_DIR=\"/usr/local/etc/sssd\"
-DSSS_NSS_MCACHE_DIR=\"/usr/local/var/lib/sss/mc\"
-DSSS_NSS_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/pam\"
-DSSS_PAC_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/pac\"
-DSSS_SUDO_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/autofs\"
-DSSS_SSH_SOCKET_NAME=\"/usr/local/var/lib/sss/pipes/ssh\"
-DLOCALEDIR=\"/usr/local/share/locale\"
-DBASE_FILE_STEM=\"libsss_util_la-sysdb_ops\" -Wall -Wshadow
-Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Wundef -Werror-implicit-function-declaration
-Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99
-O1 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-MT src/db/libsss_util_la-sysdb_ops.lo -MD -MP -MF
src/db/.deps/libsss_util_la-sysdb_ops.Tpo -c
```

Fixes: sssd-1_3_0-3-g551aa6c36

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 Makefile.am                 | 2 +-
 configure.ac                | 3 ++-
 src/tests/cwrap/Makefile.am | 1 +
 src/tests/intg/Makefile.am  | 1 +
 4 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 839b25eae0e..93c7ce08815 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -137,7 +137,7 @@ ifp_non_root_owner_policy =
 endif
 
 
-AM_CFLAGS =
+AM_CFLAGS = $(my_CFLAGS)
 if WANT_AUX_INFO
     AM_CFLAGS += -aux-info $@.X
 endif
diff --git a/configure.ac b/configure.ac
index b5222ae973f..bf172e2ec4f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -11,7 +11,8 @@ m4_ifdef([AC_USE_SYSTEM_EXTENSIONS],
     [AC_USE_SYSTEM_EXTENSIONS],
     [AC_GNU_SOURCE])
 
-CFLAGS="$CFLAGS -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE"
+my_CFLAGS="-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE"
+AC_SUBST([my_CFLAGS])
 
 
 AM_INIT_AUTOMAKE([-Wall -Wno-portability foreign subdir-objects tar-pax
diff --git a/src/tests/cwrap/Makefile.am b/src/tests/cwrap/Makefile.am
index 797d9e64073..653687d24f0 100644
--- a/src/tests/cwrap/Makefile.am
+++ b/src/tests/cwrap/Makefile.am
@@ -22,6 +22,7 @@ AM_CPPFLAGS = \
     $(OPENLDAP_CFLAGS) \
     $(GLIB2_CFLAGS) \
     $(NULL)
+AM_CFLAGS = $(my_CFLAGS)
 
 TESTS_ENVIRONMENT = \
     CWRAP_TEST_SRCDIR=$(abs_srcdir) \
diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 6283a2a9c3c..8b0c11f03dc 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -1,3 +1,4 @@
+AM_CFLAGS = $(my_CFLAGS)
 dist_noinst_DATA = \
     __init__.py \
     config.py.m4 \

From 30a980384a59c2ddc8fc256502bb02b64775873c Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 23 Oct 2024 19:21:32 +0200
Subject: [PATCH 073/129] INI: remove unused helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Btw, `sss_ini_get_mtime()` could access uninitialized 'self->cstat'

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/tests/cmocka/test_config_check.c |  1 -
 src/util/sss_ini.c                   | 24 ------------------------
 src/util/sss_ini.h                   | 12 ------------
 3 files changed, 37 deletions(-)

diff --git a/src/tests/cmocka/test_config_check.c b/src/tests/cmocka/test_config_check.c
index 988ccfc16b0..43c8f0e59ae 100644
--- a/src/tests/cmocka/test_config_check.c
+++ b/src/tests/cmocka/test_config_check.c
@@ -35,7 +35,6 @@ struct sss_ini {
     struct ref_array *ra_error_list;
     struct ini_cfgobj *sssd_config;
     struct value_obj *obj;
-    const struct stat *cstat;
     struct ini_cfgfile *file;
     bool main_config_exists;
 };
diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 2a611eb8c0d..132d61b4114 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -43,7 +43,6 @@ struct sss_ini {
     struct ref_array *ra_error_list;
     struct ini_cfgobj *sssd_config;
     struct value_obj *obj;
-    const struct stat *cstat;
     struct ini_cfgfile *file;
     bool main_config_exists;
 };
@@ -192,29 +191,6 @@ static int sss_ini_access_check(struct sss_ini *self)
 
 
 
-/* Get cstat */
-
-int sss_ini_get_stat(struct sss_ini *self)
-{
-    self->cstat = ini_config_get_stat(self->file);
-
-    if (!self->cstat) return EIO;
-
-    return EOK;
-}
-
-
-
-/* Get mtime */
-
-int sss_ini_get_mtime(struct sss_ini *self,
-                      size_t timestr_len,
-                      char *timestr)
-{
-    return snprintf(timestr, timestr_len, "%llu",
-                    (long long unsigned)self->cstat->st_mtime);
-}
-
 /* Get file_exists */
 
 bool sss_ini_exists(struct sss_ini *self)
diff --git a/src/util/sss_ini.h b/src/util/sss_ini.h
index 280ea837de2..98aaa988cb1 100644
--- a/src/util/sss_ini.h
+++ b/src/util/sss_ini.h
@@ -92,18 +92,6 @@ int sss_ini_open(struct sss_ini *self,
  */
 bool sss_ini_exists(struct sss_ini *self);
 
-/**
- * @brief get Cstat structure of the ini file
- */
-int sss_ini_get_stat(struct sss_ini *self);
-
-/**
- * @brief Get mtime of the ini file
- */
-int sss_ini_get_mtime(struct sss_ini *self,
-                      size_t timestr_len,
-                      char *timestr);
-
 /**
  * @brief Get pointer to list of snippet parsing errors
  */

From 1d19b8ad9415e0a12ed3aaf039d4d0956ef4dbad Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 23 Oct 2024 19:53:09 +0200
Subject: [PATCH 074/129] INI: stop using 'libini_config' for access check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/util/sss_ini.c | 77 ++--------------------------------------------
 src/util/sss_ini.h | 12 --------
 2 files changed, 3 insertions(+), 86 deletions(-)

diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 132d61b4114..e989d8cafc6 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -146,58 +146,6 @@ static int sss_ini_config_file_from_mem(struct sss_ini *self,
                                    &self->file);
 }
 
-/* Check configuration file permissions */
-
-static bool is_running_sssd(void)
-{
-    static char exe[1024];
-    int ret;
-    const char *s = NULL;
-
-    ret = readlink("/proc/self/exe", exe, sizeof(exe) - 1);
-    if ((ret > 0) && (ret < 1024)) {
-        exe[ret] = 0;
-        s = strstr(exe, debug_prg_name);
-        if ((s != NULL) && (strlen(s) == strlen(debug_prg_name))) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-static int sss_ini_access_check(struct sss_ini *self)
-{
-    int ret;
-    uint32_t flags = INI_ACCESS_CHECK_MODE;
-
-    if (!self->main_config_exists) {
-        return EOK;
-    }
-
-    if (is_running_sssd()) {
-        flags |= INI_ACCESS_CHECK_UID | INI_ACCESS_CHECK_GID;
-    }
-
-    ret = ini_config_access_check(self->file,
-                                  flags,
-                                  geteuid(),
-                                  getegid(),
-                                  S_IRUSR, /* r**------ */
-                                  ALLPERMS & ~(S_IWUSR|S_IXUSR));
-
-    return ret;
-}
-
-
-
-/* Get file_exists */
-
-bool sss_ini_exists(struct sss_ini *self)
-{
-    return self->main_config_exists;
-}
-
 /* Print ini_config errors */
 
 static void sss_ini_config_print_errors(char **error_list)
@@ -265,7 +213,6 @@ static int sss_ini_add_snippets(struct sss_ini *self,
     uint32_t i = 0;
     char *msg = NULL;
     struct ini_cfgobj *modified_sssd_config = NULL;
-    struct access_check snip_check;
 
     if (self == NULL || self->sssd_config == NULL || config_dir == NULL) {
         return EINVAL;
@@ -273,21 +220,11 @@ static int sss_ini_add_snippets(struct sss_ini *self,
 
     sss_ini_free_ra_messages(self);
 
-    snip_check.flags = INI_ACCESS_CHECK_MODE;
-
-    if (is_running_sssd()) {
-        snip_check.flags |= INI_ACCESS_CHECK_UID | INI_ACCESS_CHECK_GID;
-    }
-    snip_check.uid = geteuid();
-    snip_check.gid = getegid();
-    snip_check.mode = S_IRUSR; /* r**------ */
-    snip_check.mask = ALLPERMS & ~(S_IWUSR | S_IXUSR);
-
     ret = ini_config_augment(self->sssd_config,
                              config_dir,
                              patterns,
                              sections,
-                             &snip_check,
+                             NULL,
                              INI_STOP_ON_ANY,
                              INI_MV1S_OVERWRITE,
                              INI_PARSE_NOWRAP,
@@ -870,15 +807,7 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
         return ERR_INI_OPEN_FAILED;
     }
 
-    if (sss_ini_exists(self)) {
-        ret = sss_ini_access_check(self);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "Permission check on config file %s failed: %d\n",
-                  config_file, ret);
-            return ERR_INI_INVALID_PERMISSION;
-        }
-    } else {
+    if (!self->main_config_exists) {
         DEBUG(SSSDBG_CONF_SETTINGS,
               "File %s does not exist.\n", config_file);
     }
@@ -899,7 +828,7 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
         return ERR_INI_ADD_SNIPPETS_FAILED;
     }
 
-    if (!sss_ini_exists(self) &&
+    if ((!self->main_config_exists) &&
         (ref_array_len(sss_ini_get_ra_success_list(self)) == 0)) {
         return ERR_INI_EMPTY_CONFIG;
     }
diff --git a/src/util/sss_ini.h b/src/util/sss_ini.h
index 98aaa988cb1..45ede275949 100644
--- a/src/util/sss_ini.h
+++ b/src/util/sss_ini.h
@@ -80,18 +80,6 @@ int sss_ini_open(struct sss_ini *self,
                  const char *config_file,
                  const char *fallback_cfg);
 
-/**
- * @brief Check whether sss_ini_open() reported that ini file is
- *        not present
- *
- * @param[in] self  pointer to sss_ini structure
- *
- * @return
- *   - true   we are using ini file
- *   - false  file was not found
- */
-bool sss_ini_exists(struct sss_ini *self);
-
 /**
  * @brief Get pointer to list of snippet parsing errors
  */

From 8472777ec472607ea450ddb4c4666017bd0de704 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 23 Oct 2024 20:59:32 +0200
Subject: [PATCH 075/129] INI: relax config files checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only make sure:
 - user is root or sssd
 - group is root or sssd
 - other can't access it

Don't make any assumptions wrt user/group read/write-ability.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/man/sssd.conf.5.xml |  5 ++-
 src/util/sss_ini.c      | 68 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index a074cc674af..bf10acb2a77 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -57,9 +57,8 @@
             readable, and writeable only by 'root'.
         </para>
         <para condition="with_non_root_user_support">
-            <filename>sssd.conf</filename> must be a regular file that is owned,
-            readable, and writeable by the same user as configured to run SSSD
-            service.
+            <filename>sssd.conf</filename> must be a regular file that is
+            accessible only by the user used to run SSSD service or root.
         </para>
     </refsect1>
 
diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index e989d8cafc6..74cf61e0efa 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -26,6 +26,7 @@
 #include <unistd.h>
 #include <string.h>
 #include <errno.h>
+#include <sys/stat.h>
 #include <talloc.h>
 
 #include "config.h"
@@ -781,6 +782,71 @@ int sss_ini_open(struct sss_ini *self,
     return ret;
 }
 
+static int access_check_file(const char *filename)
+{
+    int ret;
+    struct stat st;
+    uid_t uid;
+    gid_t gid;
+
+    sss_sssd_user_uid_and_gid(&uid, &gid);
+
+    ret = stat(filename, &st);
+    if (ret != 0) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE, "stat(%s) failed: %s\n",
+              filename, strerror(ret));
+        return EINVAL;
+    }
+
+    if ((st.st_uid != 0) && (st.st_uid != uid)) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unexpected user owner of '%s': %"SPRIuid"\n",
+              filename, st.st_uid);
+        return ERR_INI_INVALID_PERMISSION;
+    }
+
+    if ((st.st_gid != 0) && (st.st_gid != gid)) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unexpected group owner of '%s': %"SPRIgid"\n",
+              filename, st.st_gid);
+        return ERR_INI_INVALID_PERMISSION;
+    }
+
+    if ((st.st_mode & (S_IROTH|S_IWOTH|S_IXOTH)) != 0) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unexpected access to '%s' by other users\n",
+              filename);
+        return ERR_INI_INVALID_PERMISSION;
+    }
+
+    return EOK;
+}
+
+static int access_check_ini(struct sss_ini *self)
+{
+    int ret;
+    const char *path;
+    uint32_t i;
+    const char **snippet;
+    struct ref_array *used_snippets;
+
+    if (self->main_config_exists) {
+        path = ini_config_get_filename(self->file);
+        ret = access_check_file(path);
+        if (ret != EOK) {
+            return ret;
+        }
+    }
+
+    used_snippets = sss_ini_get_ra_success_list(self);
+    for (i = 0; (snippet = ref_array_get(used_snippets, i, NULL)) != NULL; ++i) {
+        ret = access_check_file(*snippet);
+        if (ret != EOK) {
+            return ret;
+        }
+    }
+
+    return EOK;
+}
+
 int sss_ini_read_sssd_conf(struct sss_ini *self,
                            const char *config_file,
                            const char *config_dir)
@@ -833,5 +899,7 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
         return ERR_INI_EMPTY_CONFIG;
     }
 
+    ret = access_check_ini(self);
+
     return ret;
 }

From 518db322fdd5a4de41813fbe5bc35fc20392ce67 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 24 Oct 2024 15:34:26 +0200
Subject: [PATCH 076/129] Configuration: make sure /etc/sssd and everything
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

beneath is owned by 'sssd' group and readable by group.

This should allow for reasonable rw-r----- root:sssd

At some points those chown/chmod can be removed.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 contrib/sssd.spec.in                 | 4 ++--
 src/sysv/systemd/sssd-kcm.service.in | 5 ++---
 src/sysv/systemd/sssd.service.in     | 6 ++----
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 4fbacb959d6..83de563f31c 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -1136,9 +1136,9 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d /run/sssd -s /sbin/nologi
 %__rm -f %{mcpath}/group
 %__rm -f %{mcpath}/initgroups
 %__rm -f %{mcpath}/sid
+%__chown -f -R root:%{sssd_user} %{_sysconfdir}/sssd || true
+%__chmod -f -R g+r %{_sysconfdir}/sssd || true
 %__chown -f %{sssd_user}:%{sssd_user} %{dbpath}/* || true
-%__chown -f %{sssd_user}:%{sssd_user} %{_sysconfdir}/sssd/sssd.conf || true
-%__chown -f -R %{sssd_user}:%{sssd_user} %{_sysconfdir}/sssd/conf.d || true
 %__chown -f %{sssd_user}:%{sssd_user} %{_var}/log/%{name}/*.log || true
 %__chown -f %{sssd_user}:%{sssd_user} %{secdbpath}/*.ldb || true
 %__chown -f %{sssd_user}:%{sssd_user} %{gpocachepath}/* || true
diff --git a/src/sysv/systemd/sssd-kcm.service.in b/src/sysv/systemd/sssd-kcm.service.in
index 0c839ec5cee..ba9e27cd99f 100644
--- a/src/sysv/systemd/sssd-kcm.service.in
+++ b/src/sysv/systemd/sssd-kcm.service.in
@@ -9,9 +9,8 @@ Also=sssd-kcm.socket
 
 [Service]
 Environment=DEBUG_LOGGER=--logger=files
-ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@
-ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/sssd.conf
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/conf.d
+ExecStartPre=+-/bin/chown -f -R root:@SSSD_USER@ @sssdconfdir@
+ExecStartPre=+-/bin/chmod -f -R g+r @sssdconfdir@
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @secdbpath@/*.ldb"
 ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_kcm.log
 ExecStart=@libexecdir@/sssd/sssd_kcm ${DEBUG_LOGGER}
diff --git a/src/sysv/systemd/sssd.service.in b/src/sysv/systemd/sssd.service.in
index 37e0a63f87e..a6f79ff8afe 100644
--- a/src/sysv/systemd/sssd.service.in
+++ b/src/sysv/systemd/sssd.service.in
@@ -10,10 +10,8 @@ StartLimitBurst=5
 [Service]
 Environment=DEBUG_LOGGER=--logger=files
 EnvironmentFile=-@environment_file@
-ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@
-ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/sssd.conf
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/conf.d
-ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/pki
+ExecStartPre=+-/bin/chown -f -R root:@SSSD_USER@ @sssdconfdir@
+ExecStartPre=+-/bin/chmod -f -R g+r @sssdconfdir@
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @dbpath@/*.ldb"
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @gpocachepath@/*"
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/*.log"

From d7c977092c7a0df60ec627da50c207b07b333228 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 24 Oct 2024 21:47:38 +0200
Subject: [PATCH 077/129] INI: don't report used snippets in
 `sss_ini_add_snippets()`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This ends up in system journal because logger isn't initialized
yet at this point.

Snippets still can be verified via 'sssctl config-check'

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/util/sss_ini.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 74cf61e0efa..4ef5feaa002 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -239,13 +239,6 @@ static int sss_ini_add_snippets(struct sss_ini *self,
               ret);
     }
 
-    while (ref_array_get(self->ra_success_list, i, &msg) != NULL) {
-        DEBUG(SSSDBG_TRACE_FUNC,
-              "Config merge success: %s\n", msg);
-        i++;
-    }
-
-    i = 0;
     while (ref_array_get(self->ra_error_list, i, &msg) != NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Config merge error: %s\n", msg);

From 4cc62d457fd38a34bdfc986a620020c98e549cae Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 25 Oct 2024 17:09:03 +0200
Subject: [PATCH 078/129] SSSCTL: change error message to be more accurate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To avoid misleading reports like in this case:
```
 # sssctl config-check --debug 9
 [sssd] [access_check_file] (0x0020): Unexpected user owner of '/etc/sssd/conf.d/pam.conf': 65534
 Failed to read '/etc/sssd/sssd.conf': File ownership and permissions check failed
```

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/tools/sssctl/sssctl_config.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/tools/sssctl/sssctl_config.c b/src/tools/sssctl/sssctl_config.c
index 9245de2362d..0a246a6c708 100644
--- a/src/tools/sssctl/sssctl_config.c
+++ b/src/tools/sssctl/sssctl_config.c
@@ -117,7 +117,8 @@ errno_t sssctl_config_check(struct sss_cmdline *cmdline,
         goto done;
     }
     else if (ret != EOK) {
-        PRINT("Failed to read '%s': %s\n", config_path, sss_strerror(ret));
+        PRINT("Configuration validation failed: %s\n", sss_strerror(ret));
+        PRINT("Run with high debug level to see details.\n");
         goto done;
     }
 

From 60d369c00528fd0cea257f7720d3d8da252116ce Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 30 Oct 2024 10:16:03 +0100
Subject: [PATCH 079/129] INI: add verbose error messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/monitor/monitor.c |  3 +++
 src/util/sss_ini.c    | 25 ++++++++++++-------------
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index e17b0e4169c..55db0006967 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -1934,6 +1934,9 @@ int main(int argc, const char *argv[])
         ERROR("Can't read config: '%s'\n", sss_strerror(ret));
         sss_log(SSS_LOG_ALERT,
                 "Failed to read configuration: '%s'", sss_strerror(ret));
+        sss_log(SSS_LOG_ALERT,
+                "Make sure configuration is readable by the user used to run service"
+                " and doesn't have public rwx bits set.");
         ret = 3;
         goto out;
     }
diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 4ef5feaa002..0fb61d6b80c 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -235,8 +235,8 @@ static int sss_ini_add_snippets(struct sss_ini *self,
                              &self->ra_success_list);
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE,
-              "Failed to augment configuration: Error %d",
-              ret);
+              "Failed to augment configuration [%d]: %s\n",
+              ret, sss_strerror(ret));
     }
 
     while (ref_array_get(self->ra_error_list, i, &msg) != NULL) {
@@ -613,14 +613,14 @@ static int sss_ini_call_validators_errobj(struct sss_ini *data,
     ret = ini_rules_read_from_file(rules_path, &rules_cfgobj);
     if (ret != EOK) {
         DEBUG(SSSDBG_FATAL_FAILURE,
-              "Failed to read sssd.conf schema %d [%s]\n", ret, strerror(ret));
+              "Failed to read sssd.conf schema [%d]: %s\n", ret, strerror(ret));
         goto done;
     }
 
     ret = ini_rules_check(rules_cfgobj, data->sssd_config, sss_validators, errobj);
     if (ret != EOK) {
         DEBUG(SSSDBG_FATAL_FAILURE,
-              "ini_rules_check failed %d [%s]\n", ret, strerror(ret));
+              "ini_rules_check failed [%d]: %s\n", ret, strerror(ret));
         goto done;
     }
 
@@ -761,14 +761,14 @@ int sss_ini_open(struct sss_ini *self,
                                            strlen(fallback_cfg));
         if (ret != EOK) {
             DEBUG(SSSDBG_FATAL_FAILURE,
-                  "sss_ini_config_file_from_mem failed. Error %d\n",
-                  ret);
+                  "sss_ini_config_file_from_mem() failed [%d]: %s\n",
+                  ret, sss_strerror(ret));
         }
         break;
     default:
         DEBUG(SSSDBG_CONF_SETTINGS,
-              "sss_ini_config_file_open failed: Error %d\n",
-              ret);
+              "sss_ini_config_file_open() failed [%d]: %s\n",
+              ret, sss_strerror(ret));
         sss_ini_config_print_errors(self->error_list);
         break;
     }
@@ -860,9 +860,8 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
     ret = sss_ini_open(self, config_file, "[sssd]\n");
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE,
-              "sss_ini_open on %s failed: %d\n",
-              config_file,
-              ret);
+              "sss_ini_open() on '%s' failed [%d]: %s\n",
+              config_file, ret, sss_strerror(ret));
         return ERR_INI_OPEN_FAILED;
     }
 
@@ -882,8 +881,8 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
     ret = sss_ini_add_snippets(self, config_dir);
     if (ret != EOK) {
         DEBUG(SSSDBG_FATAL_FAILURE,
-              "Error while reading configuration directory %s: %d\n",
-              config_dir, ret);
+              "Error while reading configuration directory '%s' [%d]: %s\n",
+              config_dir, ret, sss_strerror(ret));
         return ERR_INI_ADD_SNIPPETS_FAILED;
     }
 

From 93eb0736ecffb77a077a2e9d0879e67d34173c15 Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Fri, 18 Oct 2024 12:33:10 +0200
Subject: [PATCH 080/129] build: fix spellos in configure.ac

"safe" is the antonym to "unsafe", but it's not like CFLAGS is unsafe.
You really want "saved" here.

Fixes: sssd-1_13_1-169-g6b01dae73

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 configure.ac | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/configure.ac b/configure.ac
index bf172e2ec4f..a7f06855f0d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -300,9 +300,9 @@ AS_IF([! $PKG_CONFIG --atleast-version 1.0.0 dbus-1], [
 ])
 
 AS_IF([test x$has_dbus != xno], [
-    SAFE_LIBS="$LIBS"
+    SAVED_LIBS="$LIBS"
     LIBS="$DBUS_LIBS"
-    SAFE_CFLAGS=$CFLAGS
+    SAVED_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $DBUS_CFLAGS"
 
     AC_CHECK_FUNC([dbus_watch_get_unix_fd],
@@ -313,8 +313,8 @@ AS_IF([test x$has_dbus != xno], [
                    [],
                    [ #include <dbus/dbus.h> ])
 
-    LIBS="$SAFE_LIBS"
-    CFLAGS=$SAFE_CFLAGS
+    LIBS="$SAVED_LIBS"
+    CFLAGS=$SAVED_CFLAGS
 ])
 
 # work around a bug in cov-build from Coverity
@@ -479,7 +479,7 @@ AS_IF([test x"$sss_cv_attribute_warn_unused_result" = xyes], [
              [whether compiler supports __attribute__((warn_unused_result))])
 ])
 
-SAFE_CFLAGS=$CFLAGS
+SAVED_CFLAGS=$CFLAGS
 CFLAGS="-Werror"
 AC_CACHE_CHECK(
     [whether compiler supports __attribute__((fallthrough))],
@@ -505,7 +505,7 @@ AC_CACHE_CHECK(
              sss_cv_attribute_fallthrough_val="((void)0)"
          ])
     ])
-CFLAGS=$SAFE_CFLAGS
+CFLAGS=$SAVED_CFLAGS
 
 AC_DEFINE_UNQUOTED(
     [SSS_ATTRIBUTE_FALLTHROUGH],

From 2d0f0480a18aacd35a51b1854736d984d378d84e Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 30 Oct 2024 14:23:48 +0100
Subject: [PATCH 081/129] chown() gpo cache recursively.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If there is something in @gpocachepath@ it will be a directory with the
domain name and in this directory will be the GPO directory hierarchy

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 contrib/sssd.spec.in             | 2 +-
 src/sysv/systemd/sssd.service.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 83de563f31c..d64c8100fdf 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -1141,7 +1141,7 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d /run/sssd -s /sbin/nologi
 %__chown -f %{sssd_user}:%{sssd_user} %{dbpath}/* || true
 %__chown -f %{sssd_user}:%{sssd_user} %{_var}/log/%{name}/*.log || true
 %__chown -f %{sssd_user}:%{sssd_user} %{secdbpath}/*.ldb || true
-%__chown -f %{sssd_user}:%{sssd_user} %{gpocachepath}/* || true
+%__chown -f -R %{sssd_user}:%{sssd_user} %{gpocachepath} || true
 
 %preun common
 %systemd_preun sssd.service
diff --git a/src/sysv/systemd/sssd.service.in b/src/sysv/systemd/sssd.service.in
index a6f79ff8afe..4f3cd24ffa4 100644
--- a/src/sysv/systemd/sssd.service.in
+++ b/src/sysv/systemd/sssd.service.in
@@ -13,7 +13,7 @@ EnvironmentFile=-@environment_file@
 ExecStartPre=+-/bin/chown -f -R root:@SSSD_USER@ @sssdconfdir@
 ExecStartPre=+-/bin/chmod -f -R g+r @sssdconfdir@
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @dbpath@/*.ldb"
-ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @gpocachepath@/*"
+ExecStartPre=+-/bin/chown -f -R @SSSD_USER@:@SSSD_USER@ @gpocachepath@
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/*.log"
 ExecStart=@sbindir@/sssd -i ${DEBUG_LOGGER}
 Type=notify

From 76682050022cba204ec5450f274a6e10a3726943 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Mon, 28 Oct 2024 14:28:33 +0100
Subject: [PATCH 082/129] SSH: sss_ssh_knownhosts must ignore DNS errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the DNS cannot resolve the provided hostname, sss_ssh_knownhosts
must not fail.

Instead it should try its best to find it. It will now try to find
the host account in IPA using both the fqdn and serverHostName
attributes (the later contains the shortname); and using the name and
nameAlias when looking for the host in the cache.

However, the IP address is not (and must not be) stored in the cache
or IPA entries, so this case will not work if the DNS fails to associate
a hostname to the provided IP address. In such a situtation, not key
will be retrieved and provided to `ssh`.

Resolves: https://github.com/SSSD/sssd/issues/7664

Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/db/sysdb_ssh.c                      | 4 +++-
 src/providers/ldap/sdap_async_hosts.c   | 5 ++++-
 src/sss_client/ssh/sss_ssh_knownhosts.c | 6 +++---
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/db/sysdb_ssh.c b/src/db/sysdb_ssh.c
index 4983dcc3405..c8920f23fc4 100644
--- a/src/db/sysdb_ssh.c
+++ b/src/db/sysdb_ssh.c
@@ -335,12 +335,14 @@ sysdb_get_ssh_host(TALLOC_CTX *mem_ctx,
         return ENOMEM;
     }
 
-    filter = talloc_asprintf(tmp_ctx, "(%s=%s)", SYSDB_NAME, name);
+    filter = talloc_asprintf(tmp_ctx, "(|(%s=%s)(%s=%s))",
+                             SYSDB_NAME, name, SYSDB_NAME_ALIAS, name);
     if (!filter) {
         ret = ENOMEM;
         goto done;
     }
 
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Searching sysdb with filter '%s'\n", filter);
     ret = sysdb_search_ssh_hosts(tmp_ctx, domain, filter, attrs,
                                  &num_hosts, &hosts);
     if (ret != EOK) {
diff --git a/src/providers/ldap/sdap_async_hosts.c b/src/providers/ldap/sdap_async_hosts.c
index 0633a3f6c35..af3aca7e6c6 100644
--- a/src/providers/ldap/sdap_async_hosts.c
+++ b/src/providers/ldap/sdap_async_hosts.c
@@ -93,9 +93,12 @@ sdap_host_info_send(TALLOC_CTX *mem_ctx,
         state->host_filter = talloc_asprintf(state, "(objectClass=%s)",
                                              host_map[SDAP_OC_HOST].name);
     } else {
-        state->host_filter = talloc_asprintf(state, "(&(objectClass=%s)(%s=%s))",
+        state->host_filter = talloc_asprintf(state,
+                                             "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
                                              host_map[SDAP_OC_HOST].name,
                                              host_map[SDAP_AT_HOST_FQDN].name,
+                                             hostname,
+                                             host_map[SDAP_AT_HOST_SERVERHOSTNAME].name,
                                              hostname);
     }
     if (state->host_filter == NULL) {
diff --git a/src/sss_client/ssh/sss_ssh_knownhosts.c b/src/sss_client/ssh/sss_ssh_knownhosts.c
index 7dd08c22945..9344345e50d 100644
--- a/src/sss_client/ssh/sss_ssh_knownhosts.c
+++ b/src/sss_client/ssh/sss_ssh_knownhosts.c
@@ -118,7 +118,7 @@ static errno_t known_hosts(TALLOC_CTX *mem_ctx, const char *domain,
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE,
                   "getaddrinfo() failed (%d): %s\n", ret, gai_strerror(ret));
-            goto done;
+            canonname = host;
         } else {
             canonname = ai->ai_canonname;
         }
@@ -128,12 +128,12 @@ static errno_t known_hosts(TALLOC_CTX *mem_ctx, const char *domain,
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE,
                   "getnameinfo() failed (%d): %s\n", ret, gai_strerror(ret));
-            goto done;
+            canonname = host;
         } else {
             canonname = canonhost;
         }
     }
-    DEBUG(SSSDBG_FUNC_DATA, "Found canonical name: %s\n", canonname);
+    DEBUG(SSSDBG_FUNC_DATA, "Looking for name: %s\n", canonname);
 
     /* look up public keys */
     ret = sss_ssh_get_ent(mem_ctx, SSS_SSH_GET_HOST_PUBKEYS,

From 3054970e441d4e3a8888922f7ccba30d985a9ce4 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Thu, 26 Sep 2024 00:13:52 -0400
Subject: [PATCH 083/129] tests: adding gpo customer test scenario to use the
 ldap attribute name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tests/system/tests/test_gpo.py | 50 ++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/src/tests/system/tests/test_gpo.py b/src/tests/system/tests/test_gpo.py
index 0bc54e329a1..619a04d2f3f 100644
--- a/src/tests/system/tests/test_gpo.py
+++ b/src/tests/system/tests/test_gpo.py
@@ -36,6 +36,7 @@
 from sssd_test_framework.roles.ad import AD
 from sssd_test_framework.roles.client import Client
 from sssd_test_framework.roles.generic import GenericADProvider
+from sssd_test_framework.roles.samba import Samba
 from sssd_test_framework.topology import KnownTopology, KnownTopologyGroup
 
 
@@ -1025,3 +1026,52 @@ def test_gpo__works_when_auto_private_group_is_used_with_posix_accounts(
         "user1", password="Secret123"
     ), "Allowed user authentication failed!"
     assert not client.auth.parametrize(method).password("deny_user1", password="Secret123"), "Denied user logged in!"
+
+
+@pytest.mark.importance("critical")
+@pytest.mark.parametrize("method", ["ssh", "su"])
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+@pytest.mark.ticket(gh=7591)
+def test_gpo__ldap_user_name_attribute_mapping(client: Client, provider: GenericADProvider, method: str):
+    """
+    :title: GPO evaluation fails when the LDAP attribute "name" is used instead of default sAMAccountName attribute
+    :description: The name attribute is not populated in Samba, limiting the test to AD
+    :setup:
+        1. Create the following user 'user1' and 'deny_user1' with uids and gids
+        2. Create and link the GPO 'site policy' and add 'user1' and 'Domain Admins' to
+           SeInteractiveLogonRight key. Add 'deny_user1 to SeDenyInteractiveLogonRight key'
+        3. Configure sssd.conf with 'ad_gpo_access_control = enforcing',
+           'auto_private_groups = false', 'ldap_user_name = name' and 'ldap_id_mapping = false'
+        4. Start SSSD
+    :steps:
+        1. Authenticate as 'user1'
+        2. Authenticate as 'deny_user1'
+    :expectedresults:
+        1. Authentication is successful
+        2. Authenticated user is unsuccessful
+    :customerscenario: True
+    """
+    user1 = provider.user("user1").add(uid=10000, gid=10000)
+    deny_user1 = provider.user("deny_user1").add(uid=10001, gid=10001)
+
+    provider.gpo("site policy").add().policy(
+        {
+            "SeInteractiveLogonRight": [user1, provider.group("Domain Admins")],
+            "SeDenyInteractiveLogonRight": [deny_user1],
+        }
+    ).link()
+
+    if isinstance(provider, Samba):
+        client.sssd.domain["ldap_user_name"] = "givenName"
+    if isinstance(provider, AD):
+        client.sssd.domain["ldap_user_name"] = "name"
+
+    client.sssd.domain["ad_gpo_access_control"] = "enforcing"
+    client.sssd.domain["auto_private_groups"] = "false"
+    client.sssd.domain["ldap_id_mapping"] = "false"
+    client.sssd.start()
+
+    assert client.auth.parametrize(method).password(
+        "user1", password="Secret123"
+    ), "Allowed user authentication failed!"
+    assert not client.auth.parametrize(method).password("deny_user1", password="Secret123"), "Denied user logged in!"

From 7a8da2762897005d854cb91eaf5024986c31f8e7 Mon Sep 17 00:00:00 2001
From: Justin Stephenson <jstephen@redhat.com>
Date: Thu, 7 Nov 2024 14:20:03 -0500
Subject: [PATCH 084/129] ipa: Check sudo command threshold correctly

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/ipa/ipa_sudo_conversion.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/providers/ipa/ipa_sudo_conversion.c b/src/providers/ipa/ipa_sudo_conversion.c
index 220d937b6fb..a502b322825 100644
--- a/src/providers/ipa/ipa_sudo_conversion.c
+++ b/src/providers/ipa/ipa_sudo_conversion.c
@@ -753,7 +753,7 @@ ipa_sudo_conv_cmd_filter(TALLOC_CTX *mem_ctx,
                          struct ipa_sudo_conv *conv,
                          int cmd_threshold)
 {
-    if (ipa_sudo_cmdgroups_exceed_threshold(conv, cmd_threshold)) {
+    if (ipa_sudo_cmds_exceed_threshold(conv, cmd_threshold)) {
         DEBUG(SSSDBG_TRACE_FUNC,
               "Command threshold [%d] exceeded, retrieving all sudo commands\n",
               cmd_threshold);

From 2d85f89f9505abdb79f2054586a8854672a832e4 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 5 Nov 2024 18:44:14 +0100
Subject: [PATCH 085/129] MAN: mistypes fixes

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/man/include/ldap_id_mapping.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/man/include/ldap_id_mapping.xml b/src/man/include/ldap_id_mapping.xml
index 25cb6e5c25f..13b6e4f1d56 100644
--- a/src/man/include/ldap_id_mapping.xml
+++ b/src/man/include/ldap_id_mapping.xml
@@ -66,7 +66,7 @@
         <para>
             The SSSD ID-mapping algorithm takes a range of available UIDs and
             divides it into equally-sized component sections - called
-            "slices"-. Each slice represents the space available to an Active
+            "slices". Each slice represents the space available to an Active
             Directory domain.
         </para>
         <para>
@@ -185,7 +185,7 @@ ldap_schema = ad
                             For example, if your most recently-added Active Directory user has
                             objectSid=S-1-5-21-2153326666-2176343378-3404031434-1107,
                             <quote>ldap_idmap_range_size</quote> must be at least 1108 as
-                            range size is equal to maximal SID minus minimal SID plus one
+                            range size is equal to maximal RID minus minimal RID plus one
                             (e.g. 1108 = 1107 - 0 + 1).
                         </para>
                         <para>

From 2d408edd97342b30761775e84108d605e423f2d3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 1 Nov 2024 14:27:14 +0100
Subject: [PATCH 086/129] pam_sss: add some missing cleanup calls.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch should avoid Coverity warnings like:

./src/sss_client/pam_sss.c:3075:17: alloc_arg: "get_authtok_for_password_change" allocates memory that is stored into "pi.first_factor".
./src/sss_client/pam_sss.c:3090:25: leaked_storage: Variable "pi" going out of scope leaks the storage "pi.first_factor" points to.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/sss_client/pam_sss.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index 4350b7f7f7e..600c3616a68 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -3037,6 +3037,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                 if (ret != PAM_SUCCESS) {
                     D(("failed to get authentication token: %s",
                        pam_strerror(pamh, ret)));
+                    overwrite_and_free_pam_items(&pi);
                     return ret;
                 }
                 break;
@@ -3091,6 +3092,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                          * would be invalid for the actual password change. So
                          * we are done. */
 
+                        overwrite_and_free_pam_items(&pi);
                         return PAM_SUCCESS;
                     }
                     task = SSS_PAM_CHAUTHTOK_PRELIM;
@@ -3103,6 +3105,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                 break;
             default:
                 D(("Illegal task [%#x]", task));
+                overwrite_and_free_pam_items(&pi);
                 return PAM_SYSTEM_ERR;
         }
 

From 8571d45b66622b152e1bf04517d573d125895d5a Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 30 Oct 2024 15:41:41 +0100
Subject: [PATCH 087/129] subdomains: check when going online
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With this patch SSSD will run the sub-domains request, if any, when
switching from offline to online state. Currently only the AD and the
IPA provider provide a sub-domains request. Besides trying to discover
the sub-domains the request will also refresh other domain wide
configurations, e.g. certificate mapping rules in the IPA provider case.
Given that it might not be clear how long the client was offline,
refreshing this data when going online makes sense.

Resolves: https://github.com/SSSD/sssd/issues/7612

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
---
 src/providers/ldap/sdap_online_check.c | 46 ++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/src/providers/ldap/sdap_online_check.c b/src/providers/ldap/sdap_online_check.c
index 9c104e54c8b..f99664562ee 100644
--- a/src/providers/ldap/sdap_online_check.c
+++ b/src/providers/ldap/sdap_online_check.c
@@ -169,9 +169,11 @@ static errno_t sdap_online_check_recv(struct tevent_req *req)
 
 struct sdap_online_check_handler_state {
     struct dp_reply_std reply;
+    struct sdap_id_ctx *id_ctx;
 };
 
 static void sdap_online_check_handler_done(struct tevent_req *subreq);
+static void sdap_online_check_subdomains_done(struct tevent_req *subreq);
 
 struct tevent_req *
 sdap_online_check_handler_send(TALLOC_CTX *mem_ctx,
@@ -191,6 +193,8 @@ sdap_online_check_handler_send(TALLOC_CTX *mem_ctx,
         return NULL;
     }
 
+    state->id_ctx = id_ctx;
+
     subreq = sdap_online_check_send(state, id_ctx);
     if (subreq == NULL) {
         ret = ENOMEM;
@@ -223,11 +227,53 @@ static void sdap_online_check_handler_done(struct tevent_req *subreq)
     ret = sdap_online_check_recv(subreq);
     talloc_zfree(subreq);
 
+    if (ret == EOK) {
+        /* Run a subdomains request, if configured, to refresh the list of
+         * known sub-domains and other domain-wide configuration data read by
+         * the configured subdomains provider. */
+        subreq = dp_req_send(state->id_ctx->be, state->id_ctx->be->provider,
+                             NULL, "Subdomains Check", 0, NULL, DPT_SUBDOMAINS,
+                             DPM_DOMAINS_HANDLER, 0, NULL , NULL);
+        if (subreq != NULL) {
+            tevent_req_set_callback(subreq, sdap_online_check_subdomains_done, req);
+            return;
+        }
+    }
+
     /* TODO For backward compatibility we always return EOK to DP now. */
     dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);
     tevent_req_done(req);
 }
 
+static void sdap_online_check_subdomains_done(struct tevent_req *subreq)
+{
+    struct sdap_online_check_handler_state *state;
+    struct tevent_req *req;
+    struct dp_reply_std *reply;
+    errno_t ret;
+
+    req = tevent_req_callback_data(subreq, struct tevent_req);
+    state = tevent_req_data(req, struct sdap_online_check_handler_state);
+
+    ret = dp_req_recv_ptr(state, subreq, struct dp_reply_std, &reply);
+    talloc_zfree(subreq);
+
+    if (ret != EOK) {
+        if (ret == ERR_MISSING_DP_TARGET) {
+            DEBUG(SSSDBG_TRACE_FUNC,
+                  "Subdomains target not configured, ignored.\n");
+        } else {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Subdomain online check failed, ignored.\n");
+        }
+    }
+
+    /* We return the EOK of the initial online check here, the result of the
+     * subdomains request is not important for the online-check request. */
+    dp_reply_std_set(&state->reply, DP_ERR_DECIDE, EOK, NULL);
+    tevent_req_done(req);
+}
+
 errno_t sdap_online_check_handler_recv(TALLOC_CTX *mem_ctx,
                                        struct tevent_req *req,
                                        struct dp_reply_std *data)

From be0c232be01b5fe2ffcaecae84980fb1b67ab916 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Mon, 9 Sep 2024 12:49:35 -0400
Subject: [PATCH 088/129] tests: removing intg/ts_cache.py

the following test cases are now covered in system/test_cache.py and
this can be removed.

* fixed assertion writes_to_both_databases tests
* added test detecting modification and deletion for groups
** test is a common user story and functional, changed priority to
critical
* added "integration" test invalidating user, group, netgroup objects

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
---
 src/tests/intg/Makefile.am           |   1 -
 src/tests/intg/test_ts_cache.py      | 681 ---------------------------
 src/tests/system/tests/test_cache.py | 169 +++++--
 3 files changed, 137 insertions(+), 714 deletions(-)
 delete mode 100644 src/tests/intg/test_ts_cache.py

diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 8b0c11f03dc..84426c17b85 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -20,7 +20,6 @@ dist_noinst_DATA = \
     test_ldap.py \
     test_memory_cache.py \
     test_session_recording.py \
-    test_ts_cache.py \
     test_netgroup.py \
     test_sssctl.py \
     files_ops.py \
diff --git a/src/tests/intg/test_ts_cache.py b/src/tests/intg/test_ts_cache.py
deleted file mode 100644
index 5bc53994bc6..00000000000
--- a/src/tests/intg/test_ts_cache.py
+++ /dev/null
@@ -1,681 +0,0 @@
-#
-# LDAP integration test - test updating the sysdb and timestamp
-#                         cache
-#
-# Copyright (c) 2016 Red Hat, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import os
-import stat
-import ent
-import grp
-import pwd
-import config
-import signal
-import subprocess
-import time
-import ldap
-import pytest
-import ds_openldap
-import ldap_ent
-import sssd_ldb
-import sssd_id
-from util import unindent
-
-LDAP_BASE_DN = "dc=example,dc=com"
-SSSD_DOMAIN = "LDAP"
-
-SCHEMA_RFC2307 = "rfc2307"
-SCHEMA_RFC2307_BIS = "rfc2307bis"
-
-TS_ATTRLIST = ("dataExpireTimestamp", "originalModifyTimestamp")
-
-
-@pytest.fixture(scope="module")
-def ds_inst(request):
-    """LDAP server instance fixture"""
-    ds_inst = ds_openldap.DSOpenLDAP(
-        config.PREFIX, 10389, LDAP_BASE_DN,
-        "cn=admin", "Secret123")
-    try:
-        ds_inst.setup()
-    except Exception:
-        ds_inst.teardown()
-        raise
-    request.addfinalizer(lambda: ds_inst.teardown())
-    return ds_inst
-
-
-@pytest.fixture(scope="module")
-def ldap_conn(request, ds_inst):
-    """LDAP server connection fixture"""
-    ldap_conn = ds_inst.bind()
-    ldap_conn.ds_inst = ds_inst
-    request.addfinalizer(lambda: ldap_conn.unbind_s())
-    return ldap_conn
-
-
-def create_ldap_fixture(request, ldap_conn, ent_list):
-    """Add LDAP entries and add teardown for removing them"""
-    for entry in ent_list:
-        ldap_conn.add_s(entry[0], entry[1])
-
-    def teardown():
-        for entry in ent_list:
-            try:
-                ldap_conn.delete_s(entry[0])
-            except ldap.NO_SUCH_OBJECT:
-                # if the test already removed an object, it's fine
-                # to not care in the teardown
-                pass
-    request.addfinalizer(teardown)
-
-
-def create_conf_fixture(request, contents):
-    """Generate sssd.conf and add teardown for removing it"""
-    conf = open(config.CONF_PATH, "w")
-    conf.write(contents)
-    conf.close()
-    os.chmod(config.CONF_PATH, stat.S_IRUSR | stat.S_IWUSR)
-    request.addfinalizer(lambda: os.unlink(config.CONF_PATH))
-
-
-def stop_sssd():
-    pid_file = open(config.PIDFILE_PATH, "r")
-    pid = int(pid_file.read())
-    os.kill(pid, signal.SIGTERM)
-    while True:
-        try:
-            os.kill(pid, signal.SIGCONT)
-        except OSError:
-            break
-        time.sleep(1)
-
-
-def create_sssd_fixture(request):
-    """Start sssd and add teardown for stopping it and removing state"""
-    if subprocess.call(["sssd", "-D", "--logger=files"]) != 0:
-        raise Exception("sssd start failed")
-
-    def teardown():
-        try:
-            stop_sssd()
-        except Exception:
-            pass
-        for path in os.listdir(config.DB_PATH):
-            os.unlink(config.DB_PATH + "/" + path)
-        for path in os.listdir(config.MCACHE_PATH):
-            os.unlink(config.MCACHE_PATH + "/" + path)
-    request.addfinalizer(teardown)
-
-
-def load_data_to_ldap(request, ldap_conn, schema):
-    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
-    ent_list.add_user("user1", 1001, 2001)
-    ent_list.add_user("user11", 1011, 2001)
-    ent_list.add_user("user21", 1021, 2001)
-
-    if schema == SCHEMA_RFC2307_BIS:
-        ent_list.add_group_bis("group1", 2001, ("user1", "user11", "user21"))
-    elif schema == SCHEMA_RFC2307:
-        ent_list.add_group("group1", 2001, ("user1", "user11", "user21"))
-    create_ldap_fixture(request, ldap_conn, ent_list)
-
-
-def load_2307bis_data_to_ldap(request, ldap_conn):
-    return load_data_to_ldap(request, ldap_conn, SCHEMA_RFC2307_BIS)
-
-
-def load_2307_data_to_ldap(request, ldap_conn):
-    return load_data_to_ldap(request, ldap_conn, SCHEMA_RFC2307)
-
-
-@pytest.fixture
-def setup_rfc2307bis(request, ldap_conn):
-    load_2307bis_data_to_ldap(request, ldap_conn)
-
-    conf = unindent("""\
-        [sssd]
-        domains             = LDAP
-        services            = nss
-
-        [nss]
-        memcache_timeout    = 1
-
-        [domain/LDAP]
-        ldap_schema             = rfc2307bis
-        id_provider             = ldap
-        auth_provider           = ldap
-        sudo_provider           = ldap
-        ldap_group_object_class = groupOfNames
-        ldap_uri                = {ldap_conn.ds_inst.ldap_url}
-        ldap_search_base        = {ldap_conn.ds_inst.base_dn}
-        ldap_id_use_start_tls   = false
-    """).format(**locals())
-    create_conf_fixture(request, conf)
-    create_sssd_fixture(request)
-    return None
-
-
-@pytest.fixture
-def setup_rfc2307(request, ldap_conn):
-    load_2307_data_to_ldap(request, ldap_conn)
-
-    conf = unindent("""\
-        [sssd]
-        domains             = LDAP
-        services            = nss
-
-        [nss]
-        memcache_timeout    = 1
-
-        [domain/LDAP]
-        ldap_schema             = rfc2307
-        id_provider             = ldap
-        auth_provider           = ldap
-        sudo_provider           = ldap
-        ldap_uri                = {ldap_conn.ds_inst.ldap_url}
-        ldap_search_base        = {ldap_conn.ds_inst.base_dn}
-        ldap_id_use_start_tls   = false
-    """).format(**locals())
-    create_conf_fixture(request, conf)
-    create_sssd_fixture(request)
-    return None
-
-
-@pytest.fixture
-def ldb_examine(request):
-    ldb_conn = sssd_ldb.SssdLdb('LDAP')
-    return ldb_conn
-
-
-def invalidate_group(ldb_conn, name):
-    ldb_conn.invalidate_entry(name, sssd_ldb.TsCacheEntry.group, SSSD_DOMAIN)
-
-
-def invalidate_user(ldb_conn, name):
-    ldb_conn.invalidate_entry(name, sssd_ldb.TsCacheEntry.user, SSSD_DOMAIN)
-
-
-def get_attrs(ldb_conn, type, name, domain, attr_list):
-    sysdb_attrs = dict()
-    ts_attrs = dict()
-
-    for attr in attr_list:
-        val = ldb_conn.get_entry_attr(sssd_ldb.CacheType.sysdb,
-                                      type, name, domain, attr)
-        if val:
-            val = val.decode('utf-8')
-        sysdb_attrs[attr] = val
-
-        val = ldb_conn.get_entry_attr(sssd_ldb.CacheType.timestamps,
-                                      type, name, domain, attr)
-        if val:
-            val = val.decode('utf-8')
-        ts_attrs[attr] = val
-    return (sysdb_attrs, ts_attrs)
-
-
-def get_group_attrs(ldb_conn, name, domain, attr_list):
-    return get_attrs(ldb_conn, sssd_ldb.TsCacheEntry.group,
-                     name, domain, attr_list)
-
-
-def get_user_attrs(ldb_conn, name, domain, attr_list):
-    return get_attrs(ldb_conn, sssd_ldb.TsCacheEntry.user,
-                     name, domain, attr_list)
-
-
-def assert_same_attrval(adict1, adict2, attr_name):
-    assert adict1.get(attr_name) is not None and \
-        adict1.get(attr_name) == adict2.get(attr_name)
-
-
-def assert_diff_attrval(adict1, adict2, attr_name):
-    assert adict1.get(attr_name) is not None and \
-        adict1.get(attr_name) != adict2.get(attr_name)
-
-
-def prime_cache_group(ldb_conn, name, members):
-    ent.assert_group_by_name(
-        name,
-        dict(mem=ent.contains_only(*members)))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, name,
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-    assert_same_attrval(sysdb_attrs, ts_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, ts_attrs, "originalModifyTimestamp")
-
-    # just to force different stamps and make sure memcache is gone
-    time.sleep(1)
-    invalidate_group(ldb_conn, name)
-
-    return sysdb_attrs, ts_attrs
-
-
-def prime_cache_user(ldb_conn, name, primary_gid):
-    # calling initgroups would add the initgExpire timestamp attribute and
-    # make sure that sss_cache doesn't add it with a value of 1,
-    # triggering a sysdb update
-    (res, errno, gids) = sssd_id.call_sssd_initgroups(name, primary_gid)
-    assert res == sssd_id.NssReturnCode.SUCCESS
-
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, name,
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-    assert_same_attrval(sysdb_attrs, ts_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, ts_attrs, "originalModifyTimestamp")
-
-    # just to force different stamps and make sure memcache is gone
-    time.sleep(1)
-    invalidate_user(ldb_conn, name)
-
-    return sysdb_attrs, ts_attrs
-
-
-def test_group_2307bis_update_same_modstamp(ldap_conn,
-                                            ldb_examine,
-                                            setup_rfc2307bis):
-    """
-    Test that a group update with the same modifyTimestamp does not trigger
-    sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    ent.assert_group_by_name(
-        "group1",
-        dict(mem=ent.contains_only("user1", "user11", "user21")))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_same_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_group_2307bis_update_same_attrs(ldap_conn,
-                                         ldb_examine,
-                                         setup_rfc2307bis):
-    """
-    Test that a group update with a different modifyTimestamp but the same
-    attrs does not trigger sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    # modify an argument we don't save to the cache. This will bump the
-    # modifyTimestamp attribute, but the attributes themselves will be the same
-    # from sssd's point of view
-    ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
-                       [(ldap.MOD_ADD, "description", b"group one")])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    ent.assert_group_by_name(
-        "group1",
-        dict(mem=ent.contains_only("user1", "user11", "user21")))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_group_2307bis_update_diff_attrs(ldap_conn,
-                                         ldb_examine,
-                                         setup_rfc2307bis):
-    """
-    Test that a group update with different attribute triggers cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    user_dn = "uid=user1,ou=Users," + ldap_conn.ds_inst.base_dn
-    ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
-                       [(ldap.MOD_DELETE, "member", user_dn.encode('utf-8'))])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    ent.assert_group_by_name(
-        "group1",
-        dict(mem=ent.contains_only("user11", "user21")))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_group_2307bis_delete_group(ldap_conn,
-                                    ldb_examine,
-                                    setup_rfc2307bis):
-    """
-    Test that deleting a group removes it from both caches
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    e = ldap_ent.group_bis(ldap_conn.ds_inst.base_dn, "group1", 2001)
-    ldap_conn.delete_s(e[0])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    with pytest.raises(KeyError):
-        grp.getgrnam("group1")
-
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-    assert sysdb_attrs.get("dataExpireTimestamp") is None
-    assert sysdb_attrs.get("originalModifyTimestamp") is None
-    assert ts_attrs.get("dataExpireTimestamp") is None
-    assert ts_attrs.get("originalModifyTimestamp") is None
-
-
-def test_group_2307_update_same_modstamp(ldap_conn,
-                                         ldb_examine,
-                                         setup_rfc2307):
-    """
-    Test that a group update with the same modifyTimestamp does not trigger
-    sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    ent.assert_group_by_name(
-        "group1",
-        dict(mem=ent.contains_only("user1", "user11", "user21")))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_same_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_group_2307_update_same_attrs(ldap_conn,
-                                      ldb_examine,
-                                      setup_rfc2307):
-    """
-    Test that a group update with a different modifyTimestamp but the same
-    attrs does not trigger sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    # modify an argument we don't save to the cache. This will bump the
-    # modifyTimestamp attribute, but the attributes themselves will be the same
-    # from sssd's point of view
-    ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
-                       [(ldap.MOD_ADD, "description", b"group one")])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    ent.assert_group_by_name(
-        "group1",
-        dict(mem=ent.contains_only("user1", "user11", "user21")))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_group_2307_update_diff_attrs(ldap_conn,
-                                      ldb_examine,
-                                      setup_rfc2307):
-    """
-    Test that a group update with different attribute triggers cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
-                       [(ldap.MOD_DELETE, "memberUid", b"user1")])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    ent.assert_group_by_name(
-        "group1",
-        dict(mem=ent.contains_only("user11", "user21")))
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_group_2307_delete_group(ldap_conn,
-                                 ldb_examine,
-                                 setup_rfc2307):
-    """
-    Test that deleting a group removes it from both caches
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    e = ldap_ent.group_bis(ldap_conn.ds_inst.base_dn, "group1", 2001)
-    ldap_conn.delete_s(e[0])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    with pytest.raises(KeyError):
-        grp.getgrnam("group1")
-
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-    assert sysdb_attrs.get("dataExpireTimestamp") is None
-    assert sysdb_attrs.get("originalModifyTimestamp") is None
-    assert ts_attrs.get("dataExpireTimestamp") is None
-    assert ts_attrs.get("originalModifyTimestamp") is None
-
-
-def test_user_update_same_modstamp(ldap_conn,
-                                   ldb_examine,
-                                   setup_rfc2307bis):
-    """
-    Test that a user update with the same modifyTimestamp does not trigger
-    sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001)
-
-    ent.assert_passwd_by_name("user1", dict(name="user1"))
-
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1",
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_same_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_user_update_same_attrs(ldap_conn,
-                                ldb_examine,
-                                setup_rfc2307bis):
-    """
-    Test that a user update with the same modifyTimestamp does not trigger
-    sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001)
-
-    # modify an argument we don't save to the cache. This will bump the
-    # modifyTimestamp attribute, but the attributes themselves will be the same
-    # from sssd's point of view
-    ldap_conn.modify_s("uid=user1,ou=Users," + ldap_conn.ds_inst.base_dn,
-                       [(ldap.MOD_ADD, "description", b"user one")])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    ent.assert_passwd_by_name("user1", dict(name="user1"))
-
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1",
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_same_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_user_update_diff_attrs(ldap_conn,
-                                ldb_examine,
-                                setup_rfc2307bis):
-    """
-    Test that a user update with the same modifyTimestamp does not trigger
-    sysdb cache update
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001)
-
-    # modify an argument we don't save to the cache. This will bump the
-    # modifyTimestamp attribute, but the attributes themselves will be the same
-    # from sssd's point of view
-    ldap_conn.modify_s("uid=user1,ou=Users," + ldap_conn.ds_inst.base_dn,
-                       [(ldap.MOD_REPLACE, "loginShell", b"/bin/zsh")])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    ent.assert_passwd_by_name("user1", dict(name="user1"))
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1",
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-    assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(sysdb_attrs, old_sysdb_attrs,
-                        "originalModifyTimestamp")
-
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp")
-    assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp")
-
-
-def test_user_2307bis_delete_user(ldap_conn,
-                                  ldb_examine,
-                                  setup_rfc2307bis):
-    """
-    Test that deleting a user removes it from both caches
-    """
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001)
-
-    e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user1", 1001, 2001)
-
-    ldap_conn.delete_s(e[0])
-    # wait for slapd to change its database
-    time.sleep(1)
-
-    with pytest.raises(KeyError):
-        pwd.getpwnam("user1")
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1",
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-    assert sysdb_attrs.get("dataExpireTimestamp") is None
-    assert sysdb_attrs.get("originalModifyTimestamp") is None
-    assert ts_attrs.get("dataExpireTimestamp") is None
-    assert ts_attrs.get("originalModifyTimestamp") is None
-
-
-def test_sss_cache_invalidate_user(ldap_conn,
-                                   ldb_examine,
-                                   setup_rfc2307bis):
-    """
-    Test that sss_cache invalidate user in both caches
-    """
-
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001)
-
-    subprocess.call(["sss_cache", "-u", "user1"])
-
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1",
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert sysdb_attrs.get("dataExpireTimestamp") == '1'
-    assert ts_attrs.get("dataExpireTimestamp") == '1'
-
-    time.sleep(1)
-    pwd.getpwnam("user1")
-    sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1",
-                                           SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert sysdb_attrs.get("dataExpireTimestamp") == '1'
-    assert_diff_attrval(ts_attrs, sysdb_attrs, "dataExpireTimestamp")
-
-
-def test_sss_cache_invalidate_group(ldap_conn,
-                                    ldb_examine,
-                                    setup_rfc2307bis):
-    """
-    Test that sss_cache invalidate group in both caches
-    """
-
-    ldb_conn = ldb_examine
-    old_sysdb_attrs, old_ts_attrs = prime_cache_group(
-        ldb_conn, "group1",
-        ("user1", "user11", "user21"))
-
-    subprocess.call(["sss_cache", "-g", "group1"])
-
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert sysdb_attrs.get("dataExpireTimestamp") == '1'
-    assert ts_attrs.get("dataExpireTimestamp") == '1'
-
-    time.sleep(1)
-    grp.getgrnam("group1")
-    sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1",
-                                            SSSD_DOMAIN, TS_ATTRLIST)
-
-    assert sysdb_attrs.get("dataExpireTimestamp") == '1'
-    assert_diff_attrval(ts_attrs, sysdb_attrs, "dataExpireTimestamp")
diff --git a/src/tests/system/tests/test_cache.py b/src/tests/system/tests/test_cache.py
index 00f5a52f21a..b2e58cafd89 100644
--- a/src/tests/system/tests/test_cache.py
+++ b/src/tests/system/tests/test_cache.py
@@ -116,10 +116,11 @@ def test_cache__writes_to_both_database_files(client: Client, provider: GenericP
     timestamps = "/var/lib/sss/db/timestamps_test.ldb"
     assert client.fs.exists(timestamps), f"Timestamp file '{timestamps}' does not exist"
 
-    ldb1 = client.ldb.search(cache, "name=user1@test,cn=users,cn=test,cn=sysdb")
-    ldb2 = client.ldb.search(timestamps, "name=user1@test,cn=users,cn=test,cn=sysdb")
-    assert ldb1 != {}, f"ldbsearch failed to find user1 in {cache}"
-    assert ldb2 != {}, f"ldbsearch failed to find user1 in {timestamps}"
+    ldb1 = client.ldb.search(cache, f"name=user1@{client.sssd.default_domain},cn=users,cn=test,cn=sysdb")
+    ldb2 = client.ldb.search(timestamps, f"name=user1@{client.sssd.default_domain},cn=users,cn=test,cn=sysdb")
+
+    assert ldb1, f"ldbsearch failed to find user1 in {cache}!"
+    assert ldb2, f"ldbsearch failed to find user1 in {timestamps}!"
 
 
 @pytest.mark.integration
@@ -146,66 +147,170 @@ def test_cache__writes_to_both_database_files_when_using_fully_qualified_names(
     provider.user("user1").add()
     client.sssd.domain["use_fully_qualified_names"] = "True"
     client.sssd.start()
-    client.tools.getent.passwd("user1@test")
+    client.tools.getent.passwd(f"user1@{client.sssd.default_domain}")
 
     cache = "/var/lib/sss/db/cache_test.ldb"
     timestamps = "/var/lib/sss/db/timestamps_test.ldb"
-    user_basedn = "name=user1@test,cn=users,cn=test,cn=sysdb"
-    ldb1 = client.ldb.search(cache, user_basedn)
-    ldb2 = client.ldb.search(timestamps, user_basedn)
+    user_dn = f"name=user1@{client.sssd.default_domain},cn=users,cn=test,cn=sysdb"
+    ldb1 = client.ldb.search(cache, user_dn)
+    ldb2 = client.ldb.search(timestamps, user_dn)
 
-    assert ldb1 != {}, f"ldbsearch failed to find user1@test in {cache}"
-    assert ldb2 != {}, f"ldbsearch failed to find user1@test in {timestamps}"
+    assert ldb1, f"ldbsearch failed to find user1 in {cache}!"
+    assert ldb2, f"ldbsearch failed to find user1 in {timestamps}!"
 
 
-@pytest.mark.integration
-@pytest.mark.importance("low")
+@pytest.mark.importance("critical")
 @pytest.mark.topology(KnownTopologyGroup.AnyProvider)
 def test_cache__user_entries_contains_latest_changes_when_modified_and_deleted(
     client: Client, provider: GenericProvider
 ):
     """
-    :title: Check ldb database for latest user changes when modified and deleted
+    :title: Checks user changes are reflected when modified and deleted
     :setup:
-        1. Add users 'user-modify' and 'user-delete'
+        1. Add users 'user1' and 'user2'
         2. Start SSSD
         3. Lookup users
     :steps:
         1. Login as users
-        2. Modify 'user-modify' shell and delete 'user-delete' and clear cache
+        2. Modify 'user1' shell and delete 'user2' and clear cache
         3. Login as users
-        4. Lookup user 'user-delete'
-        5. Lookup user 'user-modify'
+        4. Lookup user 'user2'
+        5. Lookup user 'user1'
     :expectedresults:
         1. Users logged in
-        2. User 'user-modify' is modified and user 'user-delete' is deleted
-        3. User 'user-modify' logged in
-        4. User 'user-delete' is not found
-        5. User 'user-modify' is found and shell was updated
+        2. User 'user1' is modified and user 'user2' is deleted
+        3. User 'user1' logged in
+        4. User 'user2' is not found
+        5. User 'user1' is found and shell was updated
     :customerscenario: False
     """
-    provider.user("user-modify").add(shell="/bin/bash")
-    provider.user("user-delete").add(shell="/bin/bash")
+    provider.user("user1").add(shell="/bin/bash")
+    provider.user("user2").add(shell="/bin/bash")
     client.sssd.start()
-    client.tools.getent.passwd("user-modify")
-    client.tools.getent.passwd("user-delete")
+    client.tools.getent.passwd("user1")
+    client.tools.getent.passwd("user2")
 
-    assert client.auth.ssh.password("user-modify", "Secret123"), "Login failed!"
-    assert client.auth.ssh.password("user-delete", "Secret123"), "Login failed!"
+    assert client.auth.ssh.password("user1", "Secret123"), "Login failed!"
+    assert client.auth.ssh.password("user2", "Secret123"), "Login failed!"
 
-    provider.user("user-delete").delete()
-    provider.user("user-modify").modify(shell="/bin/sh")
+    provider.user("user2").delete()
+    provider.user("user1").modify(shell="/bin/sh")
 
     client.sssctl.cache_expire(everything=True)
 
-    assert client.auth.ssh.password("user-modify", "Secret123"), "Login failed!"
-    assert not client.auth.ssh.password("user-delete", "Secret123"), "Login successful!"
+    assert client.auth.ssh.password("user1", "Secret123"), "Login failed!"
+    assert not client.auth.ssh.password("user2", "Secret123"), "Login successful!"
 
-    result = client.tools.getent.passwd("user-modify")
+    result = client.tools.getent.passwd("user1")
     assert result is not None, "User not found!"
     assert result.shell == "/bin/sh", "User shell did not update!"
 
 
+@pytest.mark.importance("critical")
+@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
+def test_cache__group_entries_contains_latest_changes_when_modified_and_deleted(
+    client: Client,
+    provider: GenericProvider,
+):
+    """
+    :title: Check latest group changes are reflected when modified and deleted
+    :setup:
+        1. Create groups 'group1' and group2'
+        2. Start SSSD
+        3. Lookup groups
+    :steps:
+        1. Create and add 'user1' to 'group1' and delete 'group2' and clear cache
+        2. Lookup group 'group1'
+        3. Lookup group 'group2'
+    :expectedresults:
+        1. User 'user1' is created and added to group 'group1'  and group 'group2' is deleted
+        2. Group 'group1' is found and contains 'user1'
+        3. Group 'group2' is not found
+    :customerscenario: False
+    """
+    group1 = provider.group("group1").add()
+    group2 = provider.group("group2").add()
+    client.sssd.start()
+
+    assert client.tools.getent.group("group1"), "Group group1 not found!"
+    assert client.tools.getent.group("group2"), "Group group2 not found!"
+
+    group1.add_member(provider.user("user1").add())
+    group2.delete()
+
+    client.sssctl.cache_expire(everything=True)
+
+    assert client.tools.getent.group("group1"), "Group group1 not found!"
+    assert "user1" in str(client.tools.getent.group("group1")), "Group group1 is missing a user!"
+    assert not client.tools.getent.group("group2"), "Group group2 found!"
+
+
+@pytest.mark.integration
+@pytest.mark.importance("low")
+@pytest.mark.parametrize("obj", ["user", "group", "netgroup"])
+@pytest.mark.parametrize("dbs", ["cache", "timestamps"])
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__invalidate_entries_in_domain_and_timestamps_caches(
+    client: Client,
+    provider: LDAP,
+    obj: str,
+    dbs: str,
+):
+    """
+    :title: Invalidates object entries in the domain and timestamps caches using dataExpireTimestamp attribute
+    :setup:
+        1. Create user, group and netgroup
+        2. Add user as a member to group and netgroup
+        3. Start SSSD and lookup user, group and netgroup
+    :steps:
+        1. Search for object attribute dataExpireTimestamp in domain and timestamps ldb caches
+        2. Clear the SSSD cache for the object
+        3. Search for the object attribute dataExpireTimestamp in domain and timestamps ldb caches
+    :expectedresults:
+        1. Attribute is found
+        2. Cache is cleared for the object
+        3. Attribute is found and the value is '[1]' meaning it is cleared
+    :customerscenario: False
+    """
+    # Unable to parametrize provider method when adding objects, so all object types are created
+    user = provider.user("user").add()
+    provider.group("group").add().add_member(user)
+    provider.netgroup("netgroup").add().add_member(user=user)
+    client.sssd.start()
+
+    assert client.tools.getent.passwd("user")
+    assert client.tools.getent.group("group")
+    assert client.tools.getent.netgroup("netgroup")
+
+    path = f"/var/lib/sss/db/{dbs}_{client.sssd.default_domain}.ldb"
+
+    # netgroups does not use the fully qualified name
+    if obj == "netgroup":
+        suffix = f"cn=netgroups,cn={client.sssd.default_domain},cn=sysdb"
+        ldb_filter = f"dn=name={obj},{suffix}"
+    else:
+        suffix = f"cn={obj}s,cn={client.sssd.default_domain},cn=sysdb"
+        ldb_filter = f"dn=name={obj}@{client.sssd.default_domain},{suffix}"
+
+    result = client.ldb.search(path, suffix, filter=ldb_filter)
+    assert result != {}, f"ldbsearch {ldb_filter} did not return any results!"
+    for _, v in result.items():
+        result_expire_time = v.get("dataExpireTimestamp")
+        assert result_expire_time is not None
+        expire_time = int(result_expire_time.pop())
+        assert expire_time > 1, f"Expire time for {dbs} does not have a valid value!"
+
+    client.host.conn.exec(["sss_cache", f"-{obj[0]}", obj])
+
+    result = client.ldb.search(path, suffix, filter=ldb_filter)
+    assert result != {}, f"ldbsearch {ldb_filter} did not return any results!"
+    for _, v in result.items():
+        result_expire_time = v.get("dataExpireTimestamp")
+        assert result_expire_time is not None
+        expire_time = int(result_expire_time.pop())
+        assert expire_time == 1, f"Expire time for {dbs} has not been cleared!"
+
+
 @pytest.mark.integration
 @pytest.mark.importance("low")
 @pytest.mark.topology(KnownTopologyGroup.AnyProvider)

From d5b648498a712db4287c0c1050a0bc415ff49948 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Mon, 21 Oct 2024 19:01:03 -0400
Subject: [PATCH 089/129] tests: converting all the ldb cache tests to use one
 provider

There is minimal benefit to run these tests against all providers.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
---
 src/tests/system/tests/test_cache.py | 59 +++++++++++-----------------
 1 file changed, 24 insertions(+), 35 deletions(-)

diff --git a/src/tests/system/tests/test_cache.py b/src/tests/system/tests/test_cache.py
index b2e58cafd89..7aa2e2bde39 100644
--- a/src/tests/system/tests/test_cache.py
+++ b/src/tests/system/tests/test_cache.py
@@ -7,6 +7,8 @@
 * Negative cache (ncache)
 * In-memory cache (memcache): test_memcache.py
 
+Note: There is not added benefit to test against all topologies, the cache tests are tested against LDAP.
+
 :requirement: Cache
 """
 
@@ -16,15 +18,14 @@
 
 import pytest
 from sssd_test_framework.roles.client import Client
-from sssd_test_framework.roles.generic import GenericProvider
 from sssd_test_framework.roles.ldap import LDAP
-from sssd_test_framework.topology import KnownTopology, KnownTopologyGroup
+from sssd_test_framework.topology import KnownTopology
 
 
 @pytest.mark.integration
 @pytest.mark.importance("low")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
-def test_cache__entries_are_refreshed_as_configured(client: Client, provider: GenericProvider):
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__entries_are_refreshed_as_configured(client: Client, provider: LDAP):
     """
     :title: Ensuring LDB cache refreshes at configured intervals
     :setup:
@@ -90,8 +91,8 @@ def test_cache__entries_are_refreshed_as_configured(client: Client, provider: Ge
 
 @pytest.mark.integration
 @pytest.mark.importance("low")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
-def test_cache__writes_to_both_database_files(client: Client, provider: GenericProvider):
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__writes_to_both_database_files(client: Client, provider: LDAP):
     """
     :title: Search for user in the following ldb databases, cache_*.ldb and timestamp_*.ldb
     :setup:
@@ -125,10 +126,8 @@ def test_cache__writes_to_both_database_files(client: Client, provider: GenericP
 
 @pytest.mark.integration
 @pytest.mark.importance("low")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
-def test_cache__writes_to_both_database_files_when_using_fully_qualified_names(
-    client: Client, provider: GenericProvider
-):
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__writes_to_both_database_files_when_using_fully_qualified_names(client: Client, provider: LDAP):
     """
     :title: Search for user using fully qualified name in the following ldb databases, cache_*.ldb and timestamp_*.ldb
     :setup:
@@ -160,10 +159,8 @@ def test_cache__writes_to_both_database_files_when_using_fully_qualified_names(
 
 
 @pytest.mark.importance("critical")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
-def test_cache__user_entries_contains_latest_changes_when_modified_and_deleted(
-    client: Client, provider: GenericProvider
-):
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__user_entries_contains_latest_changes_when_modified_and_deleted(client: Client, provider: LDAP):
     """
     :title: Checks user changes are reflected when modified and deleted
     :setup:
@@ -207,10 +204,10 @@ def test_cache__user_entries_contains_latest_changes_when_modified_and_deleted(
 
 
 @pytest.mark.importance("critical")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
+@pytest.mark.topology(KnownTopology.LDAP)
 def test_cache__group_entries_contains_latest_changes_when_modified_and_deleted(
     client: Client,
-    provider: GenericProvider,
+    provider: LDAP,
 ):
     """
     :title: Check latest group changes are reflected when modified and deleted
@@ -247,7 +244,7 @@ def test_cache__group_entries_contains_latest_changes_when_modified_and_deleted(
 
 @pytest.mark.integration
 @pytest.mark.importance("low")
-@pytest.mark.parametrize("obj", ["user", "group", "netgroup"])
+@pytest.mark.parametrize("obj", ["user", "group"])
 @pytest.mark.parametrize("dbs", ["cache", "timestamps"])
 @pytest.mark.topology(KnownTopology.LDAP)
 def test_cache__invalidate_entries_in_domain_and_timestamps_caches(
@@ -259,9 +256,9 @@ def test_cache__invalidate_entries_in_domain_and_timestamps_caches(
     """
     :title: Invalidates object entries in the domain and timestamps caches using dataExpireTimestamp attribute
     :setup:
-        1. Create user, group and netgroup
-        2. Add user as a member to group and netgroup
-        3. Start SSSD and lookup user, group and netgroup
+        1. Create user and group
+        2. Add user as a member to group
+        3. Start SSSD and lookup user, group
     :steps:
         1. Search for object attribute dataExpireTimestamp in domain and timestamps ldb caches
         2. Clear the SSSD cache for the object
@@ -275,22 +272,14 @@ def test_cache__invalidate_entries_in_domain_and_timestamps_caches(
     # Unable to parametrize provider method when adding objects, so all object types are created
     user = provider.user("user").add()
     provider.group("group").add().add_member(user)
-    provider.netgroup("netgroup").add().add_member(user=user)
     client.sssd.start()
 
     assert client.tools.getent.passwd("user")
     assert client.tools.getent.group("group")
-    assert client.tools.getent.netgroup("netgroup")
 
     path = f"/var/lib/sss/db/{dbs}_{client.sssd.default_domain}.ldb"
-
-    # netgroups does not use the fully qualified name
-    if obj == "netgroup":
-        suffix = f"cn=netgroups,cn={client.sssd.default_domain},cn=sysdb"
-        ldb_filter = f"dn=name={obj},{suffix}"
-    else:
-        suffix = f"cn={obj}s,cn={client.sssd.default_domain},cn=sysdb"
-        ldb_filter = f"dn=name={obj}@{client.sssd.default_domain},{suffix}"
+    suffix = f"cn={obj}s,cn={client.sssd.default_domain},cn=sysdb"
+    ldb_filter = f"dn=name={obj}@{client.sssd.default_domain},{suffix}"
 
     result = client.ldb.search(path, suffix, filter=ldb_filter)
     assert result != {}, f"ldbsearch {ldb_filter} did not return any results!"
@@ -303,7 +292,7 @@ def test_cache__invalidate_entries_in_domain_and_timestamps_caches(
     client.host.conn.exec(["sss_cache", f"-{obj[0]}", obj])
 
     result = client.ldb.search(path, suffix, filter=ldb_filter)
-    assert result != {}, f"ldbsearch {ldb_filter} did not return any results!"
+    assert result != {}, f"ldbsearch {ldb_filter} did not find any results in {path}"
     for _, v in result.items():
         result_expire_time = v.get("dataExpireTimestamp")
         assert result_expire_time is not None
@@ -313,8 +302,8 @@ def test_cache__invalidate_entries_in_domain_and_timestamps_caches(
 
 @pytest.mark.integration
 @pytest.mark.importance("low")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
-def test_cache__extra_attributes_are_stored(client: Client, provider: GenericProvider):
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__extra_attributes_are_stored(client: Client, provider: LDAP):
     """
     :title: Extra attributes are cached
     :setup:
@@ -354,8 +343,8 @@ def test_cache__extra_attributes_are_stored(client: Client, provider: GenericPro
 
 @pytest.mark.integration
 @pytest.mark.importance("low")
-@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
-def test_cache__extra_attributes_with_empty_values_are_ignored(client: Client, provider: GenericProvider):
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_cache__extra_attributes_with_empty_values_are_ignored(client: Client, provider: LDAP):
     """
     :title: When extra attribute of user is added but not assigned, it is neither cached nor displayed
     :setup:

From 56438ec7804e55b5d4de00e69d01d397a9905e61 Mon Sep 17 00:00:00 2001
From: Ondrej Valousek <ondrej.valousek.xm@renesas.com>
Date: Mon, 4 Nov 2024 11:51:08 +0100
Subject: [PATCH 090/129] Fix bug in objectclass_matched()

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/ldap/sdap.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 956eba93a22..a64d8c157ee 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -648,11 +648,13 @@ static bool objectclass_matched(struct sdap_attr_map *map,
         len = strlen(objcl) + 1;
     }
 
-    if (strncasecmp(map[SDAP_OC_GROUP].name, objcl, len) == 0) {
+    if (strncasecmp(map[0].name, objcl, len) == 0) {
         return true;
     }
-
-    if (map[SDAP_OC_GROUP_ALT].name != NULL
+    /* first element is always object class, and for groups also the
+     * second element (SDAP_OC_GROUP_ALT) in the array */
+    if (strcmp(map[SDAP_OC_GROUP_ALT].sys_name, SYSDB_GROUP_CLASS) == 0
+        && map[SDAP_OC_GROUP_ALT].name != NULL
         && strncasecmp(map[SDAP_OC_GROUP_ALT].name, objcl, len) == 0) {
         return true;
     }

From 71430f77727fc2262f6c54a453aca587f9d76597 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 7 Nov 2024 18:05:57 +0100
Subject: [PATCH 091/129] SPEC: require OpenSSL >= 1.0.1

This is required since a86ee649ac7cd80cfb3c1b50ae728fbf12d1b92a

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 contrib/sssd.spec.in | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index d64c8100fdf..b3c6555c4a5 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -154,10 +154,10 @@ BuildRequires: m4
 BuildRequires: make
 BuildRequires: nss_wrapper
 BuildRequires: openldap-devel
-BuildRequires: openssh
 # required for p11_child smartcard tests
-BuildRequires: openssl
-BuildRequires: openssl-devel
+BuildRequires: openssh
+BuildRequires: openssl >= 1.0.1
+BuildRequires: openssl-devel >= 1.0.1
 BuildRequires: p11-kit-devel
 BuildRequires: pam_wrapper
 BuildRequires: pam-devel

From ffec45bdbbf9d0e37077a37cba20dcf45b6d7749 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 4 Oct 2024 17:14:34 +0200
Subject: [PATCH 092/129] ssh: do not use default_domain_suffix

The default_domain_suffix is already handled in the generic cache
request code and the additional enforcement in the ssh responder might
cause issue if fully-qualified names are used as input.

With this change the ssh responder handles request data similar to the
nss responder e.g. in sss_nss_protocol_parse_name().

Resolves: https://github.com/SSSD/sssd/issues/7671

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 src/responder/ssh/ssh_cmd.c      | 3 +--
 src/responder/ssh/ssh_private.h  | 1 -
 src/responder/ssh/ssh_protocol.c | 9 ++-------
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/src/responder/ssh/ssh_cmd.c b/src/responder/ssh/ssh_cmd.c
index b9e630bb16c..29505d05dff 100644
--- a/src/responder/ssh/ssh_cmd.c
+++ b/src/responder/ssh/ssh_cmd.c
@@ -87,8 +87,7 @@ static errno_t ssh_cmd_get_user_pubkeys(struct cli_ctx *cli_ctx)
 
     cmd_ctx->cli_ctx = cli_ctx;
 
-    ret = ssh_protocol_parse_user(cli_ctx, cli_ctx->rctx->default_domain,
-                                  &cmd_ctx->name, &cmd_ctx->domain);
+    ret = ssh_protocol_parse_user(cli_ctx, &cmd_ctx->name, &cmd_ctx->domain);
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Invalid request message!\n");
         goto done;
diff --git a/src/responder/ssh/ssh_private.h b/src/responder/ssh/ssh_private.h
index 720b5ccf6e0..005652ac3eb 100644
--- a/src/responder/ssh/ssh_private.h
+++ b/src/responder/ssh/ssh_private.h
@@ -50,7 +50,6 @@ struct sss_cmd_table *get_ssh_cmds(void);
 
 errno_t
 ssh_protocol_parse_user(struct cli_ctx *cli_ctx,
-                        const char *default_domain,
                         const char **_name,
                         const char **_domain);
 
diff --git a/src/responder/ssh/ssh_protocol.c b/src/responder/ssh/ssh_protocol.c
index 5a9081bb729..bfd118db33c 100644
--- a/src/responder/ssh/ssh_protocol.c
+++ b/src/responder/ssh/ssh_protocol.c
@@ -136,7 +136,6 @@ static void got_ssh_keys(struct tevent_req *req)
 
 static errno_t
 ssh_protocol_parse_request(struct cli_ctx *cli_ctx,
-                           const char *default_domain,
                            const char **_name,
                            const char **_alias,
                            const char **_domain)
@@ -209,8 +208,6 @@ ssh_protocol_parse_request(struct cli_ctx *cli_ctx,
                 return EINVAL;
             }
             c += domain_len;
-        } else {
-            domain = default_domain;
         }
 
         DEBUG(SSSDBG_TRACE_FUNC,
@@ -234,12 +231,10 @@ ssh_protocol_parse_request(struct cli_ctx *cli_ctx,
 
 errno_t
 ssh_protocol_parse_user(struct cli_ctx *cli_ctx,
-                        const char *default_domain,
                         const char **_name,
                         const char **_domain)
 {
-    return ssh_protocol_parse_request(cli_ctx, default_domain,
-                                      _name, NULL, _domain);
+    return ssh_protocol_parse_request(cli_ctx, _name, NULL, _domain);
 }
 
 errno_t
@@ -248,5 +243,5 @@ ssh_protocol_parse_host(struct cli_ctx *cli_ctx,
                         const char **_alias,
                         const char **_domain)
 {
-    return ssh_protocol_parse_request(cli_ctx, NULL, _name, _alias, _domain);
+    return ssh_protocol_parse_request(cli_ctx, _name, _alias, _domain);
 }

From fb91349cfeba653942b32141f890e3de78b3fb13 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 30 Oct 2024 11:16:44 +0100
Subject: [PATCH 093/129] responders: deprecate default_domain_suffix option

:relnote: The option default_domain_suffix is deprecated. Consider using
the more flexible domain_resolution_order instead.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 src/man/sssd.conf.5.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index bf10acb2a77..a8414774775 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -418,6 +418,10 @@
                     <varlistentry>
                         <term>default_domain_suffix (string)</term>
                         <listitem>
+                            <para>
+                                Please note that this option is deprecated and
+                                domain_resolution_order should be used.
+                            </para>
                             <para>
                                 This string will be used as a default domain
                                 name for all names without a domain name

From 9ee10f98e0070774e0e7f0794bc296ef06a671e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Thu, 14 Nov 2024 17:27:49 +0100
Subject: [PATCH 094/129] OPTS: Add the option for DP_OPT_DYNDNS_REFRESH_OFFSET

The label `DP_OPT_DYNDNS_REFRESH_OFFSET` was introduced in
https://github.com/SSSD/sssd/blob/fb91349cfeba653942b32141f890e3de78b3fb13/src/providers/be_dyndns.h#L55
but the corresponding option is missing in
https://github.com/SSSD/sssd/blob/fb91349cfeba653942b32141f890e3de78b3fb13/src/providers/be_dyndns.c#L1200

This error was introduced by
https://github.com/SSSD/sssd/commit/35c35de42012481a6bd2690d12d5d11a4ae23ea5

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/be_dyndns.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/providers/be_dyndns.c b/src/providers/be_dyndns.c
index 2c655ef1eeb..5d0f5111977 100644
--- a/src/providers/be_dyndns.c
+++ b/src/providers/be_dyndns.c
@@ -1201,6 +1201,7 @@ static struct dp_option default_dyndns_opts[] = {
     { "dyndns_update", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "dyndns_update_per_family", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "dyndns_refresh_interval", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },
+    { "dyndns_refresh_interval_offset", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },
     { "dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "dyndns_ttl", DP_OPT_NUMBER, { .number = 1200 }, NULL_NUMBER },
     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },

From 2c72834e657197012b3a32207ffe307e8ba5f9e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Thu, 14 Nov 2024 18:46:44 +0100
Subject: [PATCH 095/129] TESTS: Also test default_dyndns_opts

Compare this structure to ipa_dyndns_opts, which is already compared
to ad_dyndns_opts.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/be_dyndns.c      | 2 +-
 src/providers/be_dyndns.h      | 1 +
 src/tests/ipa_ldap_opt-tests.c | 6 ++++++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/providers/be_dyndns.c b/src/providers/be_dyndns.c
index 5d0f5111977..e6fa7dfd69e 100644
--- a/src/providers/be_dyndns.c
+++ b/src/providers/be_dyndns.c
@@ -1197,7 +1197,7 @@ be_nsupdate_check(void)
     return ret;
 }
 
-static struct dp_option default_dyndns_opts[] = {
+struct dp_option default_dyndns_opts[] = {
     { "dyndns_update", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "dyndns_update_per_family", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "dyndns_refresh_interval", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },
diff --git a/src/providers/be_dyndns.h b/src/providers/be_dyndns.h
index 2185fee9563..719c1394255 100644
--- a/src/providers/be_dyndns.h
+++ b/src/providers/be_dyndns.h
@@ -63,6 +63,7 @@ enum dp_dyndns_opts {
 
     DP_OPT_DYNDNS /* attrs counter */
 };
+extern struct dp_option default_dyndns_opts[DP_OPT_DYNDNS + 1];
 
 #define DYNDNS_REMOVE_A     0x1
 #define DYNDNS_REMOVE_AAAA  0x2
diff --git a/src/tests/ipa_ldap_opt-tests.c b/src/tests/ipa_ldap_opt-tests.c
index a1a0e9cc6db..da990acaf9a 100644
--- a/src/tests/ipa_ldap_opt-tests.c
+++ b/src/tests/ipa_ldap_opt-tests.c
@@ -103,6 +103,10 @@ START_TEST(test_compare_opts)
     ret = compare_dp_options(ipa_dyndns_opts, DP_OPT_DYNDNS,
                              ad_dyndns_opts);
     ck_assert_msg(ret == EOK, "[%s]", strerror(ret));
+
+    ret = compare_dp_options(ipa_dyndns_opts, DP_OPT_DYNDNS,
+                             default_dyndns_opts);
+    ck_assert_msg(ret == EOK, "[%s]", strerror(ret));
 }
 END_TEST
 
@@ -200,6 +204,8 @@ START_TEST(test_dp_opt_sentinel)
 
     fail_unless_dp_opt_is_terminator(&default_krb5_opts[KRB5_OPTS]);
 
+    fail_unless_dp_opt_is_terminator(&default_dyndns_opts[DP_OPT_DYNDNS]);
+
     fail_unless_dp_opt_is_terminator(&ad_basic_opts[AD_OPTS_BASIC]);
     fail_unless_dp_opt_is_terminator(&ad_def_ldap_opts[SDAP_OPTS_BASIC]);
     fail_unless_dp_opt_is_terminator(&ad_def_krb5_opts[KRB5_OPTS]);

From b74fe65b65c02a1470b731b012ad5b4723ce03b3 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 7 Nov 2024 18:12:31 +0100
Subject: [PATCH 096/129] SPEC: untie capabilities of different binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

as those do not have to be the same

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 Makefile.am          | 7 +++----
 contrib/sssd.spec.in | 9 +++------
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 93c7ce08815..35c2088493b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5569,14 +5569,13 @@ else
 	$(MKDIR_P) $(DESTDIR)$(initdir)
 endif
 
-CHILD_CAPABILITIES="cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep"
 if SSSD_USER
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/ldap_child
-	-$(SETCAP) $(CHILD_CAPABILITIES) $(DESTDIR)$(sssdlibexecdir)/ldap_child
+	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
-	-$(SETCAP) $(CHILD_CAPABILITIES) $(DESTDIR)$(sssdlibexecdir)/krb5_child
+	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/proxy_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/sssd_pam
@@ -5585,7 +5584,7 @@ if SSSD_USER
 if BUILD_SELINUX
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/selinux_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/selinux_child
-	-$(SETCAP) $(CHILD_CAPABILITIES) $(DESTDIR)$(sssdlibexecdir)/selinux_child
+	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/selinux_child
 endif
 endif
 
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index b3c6555c4a5..ed63944882e 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -23,9 +23,6 @@
 %global use_sysusers 0
 %endif
 
-# Capabilities of privileged child helpers (required even if SSSD runs under root)
-%global child_capabilities cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep
-
 %if 0%{?fedora} >= 35 || 0%{?rhel} >= 9
 %global build_subid 1
 %else
@@ -916,8 +913,8 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %files krb5-common
 %license COPYING
 %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
-%attr(0750,root,%{sssd_user}) %caps(%{child_capabilities}) %{_libexecdir}/%{servicename}/ldap_child
-%attr(0750,root,%{sssd_user}) %caps(%{child_capabilities}) %{_libexecdir}/%{servicename}/krb5_child
+%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/ldap_child
+%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang
 %license COPYING
@@ -935,7 +932,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %license COPYING
 %attr(770,%{sssd_user},%{sssd_user}) %dir %{keytabdir}
 %{_libdir}/%{name}/libsss_ipa.so
-%attr(0750,root,%{sssd_user}) %caps(%{child_capabilities}) %{_libexecdir}/%{servicename}/selinux_child
+%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/selinux_child
 %{_mandir}/man5/sssd-ipa.5*
 
 %files ad -f sssd_ad.lang

From 7ce14e7f73af9c531a1034fcb315b167f02e21e3 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 7 Nov 2024 18:14:37 +0100
Subject: [PATCH 097/129] LDAP_CHILD: replace 'cap_dac_override' with
 'cap_dac_read_search'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'cap_dac_read_search' is needed to read a keytab but 'cap_dac_override'
(that allows to bypass file write permission checks) shouldn't be required.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 Makefile.am          | 2 +-
 contrib/sssd.spec.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 35c2088493b..ece51a79664 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5572,7 +5572,7 @@ endif
 if SSSD_USER
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/ldap_child
-	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/ldap_child
+	-$(SETCAP) cap_chown,cap_dac_read_search,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index ed63944882e..cd23ea3b979 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -913,7 +913,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %files krb5-common
 %license COPYING
 %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
-%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/ldap_child
+%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_read_search,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/ldap_child
 %attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang

From 942799d5e7d9f30ad8aa4bdf3cccac8e954a9d8e Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 8 Nov 2024 16:33:18 +0100
Subject: [PATCH 098/129] LDAP_CHILD: don't require any capabilities besides
 'cap_dac_read_search'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 Makefile.am          | 2 +-
 contrib/sssd.spec.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index ece51a79664..348c3377ad9 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5572,7 +5572,7 @@ endif
 if SSSD_USER
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/ldap_child
-	-$(SETCAP) cap_chown,cap_dac_read_search,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/ldap_child
+	-$(SETCAP) cap_dac_read_search=ep $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index cd23ea3b979..a13f18b8766 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -913,7 +913,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %files krb5-common
 %license COPYING
 %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
-%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_read_search,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/ldap_child
+%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=ep) %{_libexecdir}/%{servicename}/ldap_child
 %attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang

From 5ef1efc52d6902ddfc1abe12a375655c2b8f90b2 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 8 Nov 2024 21:46:09 +0100
Subject: [PATCH 099/129] LDAP_CHILD: require only
 'cap_dac_read_search=permitted'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

and raise to 'effective' when needed.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 Makefile.am                     | 2 +-
 contrib/sssd.spec.in            | 2 +-
 src/providers/ldap/ldap_child.c | 6 ++++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 348c3377ad9..315cc6b804f 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5572,7 +5572,7 @@ endif
 if SSSD_USER
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/ldap_child
-	-$(SETCAP) cap_dac_read_search=ep $(DESTDIR)$(sssdlibexecdir)/ldap_child
+	-$(SETCAP) cap_dac_read_search=p $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index a13f18b8766..73472e2912a 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -913,7 +913,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %files krb5-common
 %license COPYING
 %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
-%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=ep) %{_libexecdir}/%{servicename}/ldap_child
+%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=p) %{_libexecdir}/%{servicename}/ldap_child
 %attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang
diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index 5fdf47d20f2..868c256e30f 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -891,8 +891,10 @@ static krb5_error_code privileged_krb5_setup(struct input_buffer *ibuf)
     }
     DEBUG(SSSDBG_TRACE_INTERNAL, "Kerberos context initialized\n");
 
+    sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
     kerr = copy_keytab_into_memory(ibuf, ibuf->context, ibuf->keytab_name,
                                    &keytab_name, NULL);
+    sss_drop_all_caps();
     if (kerr != 0) {
         DEBUG(SSSDBG_OP_FAILURE, "copy_keytab_into_memory failed.\n");
         return kerr;
@@ -911,10 +913,12 @@ static errno_t handle_select_principal(TALLOC_CTX *mem_ctx,
     char *sasl_primary = NULL;
     char *sasl_realm = NULL;
 
+    sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
     ret = select_principal_from_keytab(mem_ctx,
                                        ibuf->princ_str, ibuf->realm_str,
                                        ibuf->keytab_name,
                                        NULL, &sasl_primary, &sasl_realm);
+    sss_drop_all_caps();
     if (ret != 0) {
         DEBUG(SSSDBG_CRIT_FAILURE, "select_principal_from_keytab() failed\n");
         return ret;
@@ -946,8 +950,6 @@ static errno_t handle_get_tgt(TALLOC_CTX *mem_ctx,
 
     DEBUG(SSSDBG_TRACE_INTERNAL, "Kerberos context initialized\n");
 
-    sss_drop_all_caps();
-
     DEBUG(SSSDBG_TRACE_INTERNAL,
           "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
 

From 23d9c93b971c60b5535444e6782b5970f56ce24e Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Sat, 9 Nov 2024 11:27:52 +0100
Subject: [PATCH 100/129] Describe current capabilities usage.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Take a note that usage of cap_dac_override + chown to create cache path
components could be changed to use cap_dac_override + (granted anyway) setuid,
but not sure if it's worth the trouble.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 Makefile.am | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Makefile.am b/Makefile.am
index 315cc6b804f..1b9484e1c66 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -100,6 +100,15 @@ ifp_systemdservice = SystemdService=sssd-ifp.service
 condconfigexists = ConditionPathExists=\|/etc/sssd/sssd.conf\nConditionDirectoryNotEmpty=\|/etc/sssd/conf.d/
 
 # Bounding set needs to list capabilities required by ldap/krb5/selinux_childs and sssd_pam, otherwise they can't gain it.
+# Capabilities usage by binaries:
+#   - 'ldap_child': read keytab (dac_read_search)
+#   - 'krb5_child':
+#         - store TGT for a given user (set*id);
+#         - create path components of DIR:/FILE: cache, for example: /run/user/$UID (dac_override, chown)
+#         - read keytab (dac_read_search could be enough but dac_override due to above)
+#     If system doesn't need to support DIR:/FILE: then 'cap_chown' can be stripped and 'cap_dac_override' replaced with 'dac_read_search'
+#   - 'selinux_child': currently chown, dac_override, set*id  --  to be narrowed
+#   - 'sssd_pam': read keytab in gss ops (dac_read_search)
 capabilities = CapabilityBoundingSet= CAP_CHOWN CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID CAP_DAC_READ_SEARCH
 
 if BUILD_CONF_SERVICE_USER_SUPPORT

From 507d2daa86e15e8252e248ef522b6bcae958193c Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 12 Nov 2024 11:41:24 +0100
Subject: [PATCH 101/129] CLIENT: don't try to lookup `getservbyport(0, ...)`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'sssd_nss' won't handle this request anyway.

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/sss_client/nss_services.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/sss_client/nss_services.c b/src/sss_client/nss_services.c
index 4f44cb29c03..53aa95fef05 100644
--- a/src/sss_client/nss_services.c
+++ b/src/sss_client/nss_services.c
@@ -292,6 +292,11 @@ _nss_sss_getservbyport_r(int port, const char *protocol,
 	return NSS_STATUS_TRYAGAIN;
     }
 
+    if (port == 0) {
+        *errnop = EINVAL;
+        return NSS_STATUS_NOTFOUND;
+    }
+
     if (protocol) {
         ret = sss_strnlen(protocol, SSS_NAME_MAX, &proto_len);
         if (ret != 0) {

From 1f8040de29a4d7c73521134a9faeca4e6767178b Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 8 Nov 2024 15:38:26 +0100
Subject: [PATCH 102/129] SSSDConfig: chown file to root:sssd
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an addition to https://github.com/SSSD/sssd/pull/7667

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/config/SSSDConfig/__init__.py.in |  4 ++--
 src/config/SSSDConfigTest.py         | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 006e20903e8..d0d9e6a8907 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -1061,7 +1061,7 @@ class SSSDConfig(SSSDChangeConf):
             outputfile = self.configfile
 
         # open() will raise IOError if it fails
-        old_umask = os.umask(0o177)
+        old_umask = os.umask(0o137)
         with open(outputfile, "w") as of:
             output = self.dump(self.opts)
             of.write(output)
@@ -1073,7 +1073,7 @@ class SSSDConfig(SSSDChangeConf):
         if service_user == "":
             service_user = "root"
         with suppress(PermissionError):
-            shutil.chown(outputfile, service_user, service_user)
+            shutil.chown(outputfile, "root", service_user)
 
     def list_active_services(self):
         """
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 1ce4637eda7..6087f6e085b 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -180,8 +180,8 @@ def testCreateNewLDAPConfig(self):
         mode = os.stat(of)[ST_MODE]
 
         # Output files should not be readable or writable by
-        # non-owners, and should not be executable by anyone
-        self.assertFalse(S_IMODE(mode) & 0o177)
+        # others, and should not be executable by anyone
+        self.assertFalse(S_IMODE(mode) & 0o137)
 
         # try to import saved configuration file
         config = SSSDConfig.SSSDConfig(srcdir + "/etc/sssd.api.conf",
@@ -231,8 +231,8 @@ def testModifyExistingConfig(self):
         mode = os.stat(of)[ST_MODE]
 
         # Output files should not be readable or writable by
-        # non-owners, and should not be executable by anyone
-        self.assertFalse(S_IMODE(mode) & 0o177)
+        # others, and should not be executable by anyone
+        self.assertFalse(S_IMODE(mode) & 0o137)
 
         # try to import saved configuration file
         config = SSSDConfig.SSSDConfig(srcdir + "/etc/sssd.api.conf",
@@ -1908,8 +1908,8 @@ def testSaveDomain(self):
         mode = os.stat(of)[ST_MODE]
 
         # Output files should not be readable or writable by
-        # non-owners, and should not be executable by anyone
-        self.assertFalse(S_IMODE(mode) & 0o177)
+        # others, and should not be executable by anyone
+        self.assertFalse(S_IMODE(mode) & 0o137)
 
         # Remove the output file
         os.unlink(of)

From 9c4a51fa1031b49a4d45c69a46719d2a398924ff Mon Sep 17 00:00:00 2001
From: aborah-sudo <aborah@redhat.com>
Date: Wed, 16 Oct 2024 09:09:11 +0530
Subject: [PATCH 103/129] Tests: Test transformation of bash-ldap-id-ldap-auth
 netgroup

Test transformation of bash-ldap-id-ldap-auth netgroup

Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
---
 src/tests/system/tests/test_netgroups.py | 132 ++++++++++++++++++++++-
 1 file changed, 131 insertions(+), 1 deletion(-)

diff --git a/src/tests/system/tests/test_netgroups.py b/src/tests/system/tests/test_netgroups.py
index 87ebafd21f2..ff952348efe 100644
--- a/src/tests/system/tests/test_netgroups.py
+++ b/src/tests/system/tests/test_netgroups.py
@@ -7,9 +7,12 @@
 from __future__ import annotations
 
 import pytest
+from sssd_test_framework.roles.ad import AD
 from sssd_test_framework.roles.client import Client
 from sssd_test_framework.roles.generic import GenericProvider
-from sssd_test_framework.topology import KnownTopologyGroup
+from sssd_test_framework.roles.ldap import LDAP
+from sssd_test_framework.roles.samba import Samba
+from sssd_test_framework.topology import KnownTopology, KnownTopologyGroup
 
 
 @pytest.mark.importance("medium")
@@ -108,3 +111,130 @@ def test_netgroups__add_remove_netgroup_member(client: Client, provider: Generic
     assert len(result.members) == 1
     assert "(-, user-1)" not in result.members
     assert "(-, user-2)" in result.members
+
+
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.LDAP)
+@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopology.Samba)
+def test_netgroup__user_attribute_membernisnetgroup_uses_group_dn(client: Client, provider: GenericProvider):
+    """
+    :title: User's 'memberNisNetgroup' attribute values are the DN of the group
+    :setup:
+        1. Create users and groups
+        2. Create a new netgroup "group" and add a member (ng1)
+        3. Create another netgroup "nested_group" and add a member (ng2)
+        4. Modify the "nested_group" to replace its members with the members of group
+        5. Start SSSD
+    :steps:
+        1. Retrieve all members of the "nested_group"
+        2. Confirm that the member directly added to "nested_group" is present
+        3. Confirm that the member from "group" is now part of "nested_group"
+    :expectedresults:
+        1. All members should be retrieved
+        2. Members directly added to "nested_group" is present
+        3. Members from group is now part of "nested_group"
+    :customerscenario: False
+    """
+    if isinstance(provider, (LDAP, Samba, AD)):
+        for id in [1, 2]:
+            provider.user(f"ng{id}").add()
+
+        netgroup_group = provider.netgroup("group").add()
+        netgroup_group.add_member(host="testhost1", user="ng1", domain="ldap.test")
+
+        netgroup_nested = provider.netgroup("nested_group").add()
+        netgroup_nested.add_member(host="testhost2", user="ng2", domain="ldap.test")
+        netgroup_nested.add_member(ng="group")
+        client.sssd.start()
+
+        result = client.tools.getent.netgroup("nested_group")
+        assert result is not None
+        assert "(testhost2, ng2, ldap.test)" in result.members
+        assert "(testhost1, ng1, ldap.test)" in result.members
+
+
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.LDAP)
+@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopology.Samba)
+def test_netgroup__lookup_nested_groups(client: Client, provider: GenericProvider):
+    """
+    :title: Looking up nested netgroups
+    :setup:
+        1. Create users and groups
+        2. Create netgroups and add members
+        3. Add members to "nested_netgroup"
+        4. Make "netgroup" and "nested_netgroup" members of one another, looping the groups
+        5. Start SSSD
+    :steps:
+        1. Lookup "nested_netgroup"
+    :expectedresults:
+        1. Netgroup is found and both netgroups and users are members
+    :customerscenario: False
+    """
+    if isinstance(provider, (LDAP, Samba, AD)):
+        for id in [1, 2, 3]:
+            provider.user(f"ng{id}").add()
+
+        netgroup = provider.netgroup("group").add()
+        netgroup.add_member(host="testhost1", user="ng1", domain="ldap.test")
+
+        nested_netgroup = provider.netgroup("nested_netgroup").add()
+        nested_netgroup.add_member(ng=netgroup)
+        nested_netgroup.add_member(host="testhost2", user="ng2", domain="ldap.test")
+        nested_netgroup.add_member(user="ng3")
+
+        netgroup.add_member(ng=nested_netgroup)
+
+        client.sssd.start()
+
+        result = client.tools.getent.netgroup("nested_netgroup")
+        assert result is not None
+        assert "(testhost1,ng1,ldap.test)" in result.members
+        assert "(-,ng3,)" in result.members
+        assert "(testhost2,ng2,ldap.test)" in result.members
+
+
+@pytest.mark.parametrize(
+    "user, domain, expected",
+    [("host", "host.ldap.test", "(host,-,host.ldap.test)"), ("ng3", "", "(-,ng3,)")],
+)
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.LDAP)
+@pytest.mark.topology(KnownTopology.AD)
+@pytest.mark.topology(KnownTopology.Samba)
+def test_netgroup__lookup_nested_groups_with_host_and_domain_values_present(
+    client: Client, provider: GenericProvider, user: str, domain: str, expected: str
+):
+    """
+    :title: Netgroup contains a member that has a host and domain specified
+    :setup:
+        1. Create users and groups
+        2. Create netgroups and add members
+        3. Start SSSD
+    :steps:
+        1. Lookup netgroup "nested_group"
+    :expectedresults:
+        1. Member is present in the "nested_group"
+    :customerscenario: False
+    """
+    if isinstance(provider, (LDAP, Samba, AD)):
+        for id in [1, 2]:
+            provider.user(f"ng{id}").add()
+
+        netgroup_group = provider.netgroup("group").add()
+        netgroup_group.add_member(host="testhost1", user="ng1", domain="ldap.test")
+
+        netgroup_nested = provider.netgroup("nested_group").add()
+        netgroup_nested.add_member(host="testhost2", user="ng2", domain="ldap.test")
+        if domain == "host.ldap.test":
+            netgroup_nested.add_member(host=user, domain=domain)
+        else:
+            netgroup_nested.add_member(user=user)
+
+        client.sssd.start()
+
+        result = client.tools.getent.netgroup("nested_group")
+        assert result is not None
+        assert expected in result.members

From 3294cdb09876e9279e78ab95b5a96a41a9821e1f Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 19 Nov 2024 15:32:40 +0100
Subject: [PATCH 104/129] CI: COPR: add c10s buildroot

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
---
 .github/workflows/copr_build.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/copr_build.yml b/.github/workflows/copr_build.yml
index b09481045e5..d7b352b2e38 100644
--- a/.github/workflows/copr_build.yml
+++ b/.github/workflows/copr_build.yml
@@ -90,7 +90,7 @@ jobs:
         project: ${{ env.COPR_PROJECT }}
         account: ${{ env.COPR_ACCOUNT }}
 
-    - name: Add buildroot repository to CentOS Stream
+    - name: Add buildroot repository to CentOS Streams
       env:
         coprcfg: ${{ steps.copr.outputs.coprcfg }}
       run: |
@@ -99,6 +99,11 @@ jobs:
           --repos 'https://kojihub.stream.centos.org/kojifiles/repos/c9s-build/latest/$basearch/' \
           $COPR_ACCOUNT/$COPR_PROJECT/centos-stream-9-x86_64
 
+        # CentOS Stream 10
+        copr-cli --config "$coprcfg" edit-chroot                                                  \
+          --repos 'https://kojihub.stream.centos.org/kojifiles/repos/c10s-build/latest/$basearch/' \
+          $COPR_ACCOUNT/$COPR_PROJECT/centos-stream-10-x86_64
+
   build:
     runs-on: ubuntu-latest
     needs: [prepare]

From 21c6280556f4c8e035d1e78e6a51e1068d3ec92c Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 15 Nov 2024 16:11:09 +0100
Subject: [PATCH 105/129] 'dtrace' was moved to a separate package on C10S as
 well

Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 contrib/ci/deps.sh   | 6 ++++++
 contrib/sssd.spec.in | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/contrib/ci/deps.sh b/contrib/ci/deps.sh
index d5cc40fe1ed..3803c782620 100644
--- a/contrib/ci/deps.sh
+++ b/contrib/ci/deps.sh
@@ -48,6 +48,12 @@ if [[ "$DISTRO_BRANCH" == -redhat-* ]]; then
         libcap-devel
     )
 
+    if [[ "$DISTRO_BRANCH" == -redhat-fedora-4[1-9]* ||
+          "$DISTRO_BRANCH" == -redhat-redhatenterprise*-10.*- ||
+          "$DISTRO_BRANCH" == -redhat-centos*-10*- ]]; then
+        DEPS_LIST+=(systemtap-sdt-dtrace)
+    fi
+
     if [[ "$DISTRO_BRANCH" == -redhat-fedora-4[0-9]* ||
           "$DISTRO_BRANCH" == -redhat-fedora-3[7-9]* ||
           "$DISTRO_BRANCH" == -redhat-redhatenterprise*-9.*- ||
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 73472e2912a..71d3285ffa2 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -172,7 +172,7 @@ BuildRequires: softhsm >= 2.1.0
 BuildRequires: bc
 BuildRequires: systemd-devel
 BuildRequires: systemtap-sdt-devel
-%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 41 || 0%{?rhel} >= 10
 BuildRequires: systemtap-sdt-dtrace
 %endif
 BuildRequires: uid_wrapper

From a926f43ac17e46dd37b3ecc545f09c903651b327 Mon Sep 17 00:00:00 2001
From: aborah-sudo <aborah@redhat.com>
Date: Tue, 19 Nov 2024 20:02:19 +0530
Subject: [PATCH 106/129] Tests: Reverse the condition and fail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, the test will blindly fail if someone carelessly adds IPA to the topologies.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/tests/system/tests/test_netgroups.py | 91 ++++++++++++------------
 1 file changed, 47 insertions(+), 44 deletions(-)

diff --git a/src/tests/system/tests/test_netgroups.py b/src/tests/system/tests/test_netgroups.py
index ff952348efe..ad74f085b49 100644
--- a/src/tests/system/tests/test_netgroups.py
+++ b/src/tests/system/tests/test_netgroups.py
@@ -136,22 +136,23 @@ def test_netgroup__user_attribute_membernisnetgroup_uses_group_dn(client: Client
         3. Members from group is now part of "nested_group"
     :customerscenario: False
     """
-    if isinstance(provider, (LDAP, Samba, AD)):
-        for id in [1, 2]:
-            provider.user(f"ng{id}").add()
+    if not isinstance(provider, (LDAP, Samba, AD)):
+        raise ValueError("IPA does not support domain in netgroups")
+    for id in [1, 2]:
+        provider.user(f"ng{id}").add()
 
-        netgroup_group = provider.netgroup("group").add()
-        netgroup_group.add_member(host="testhost1", user="ng1", domain="ldap.test")
+    netgroup_group = provider.netgroup("group").add()
+    netgroup_group.add_member(host="testhost1", user="ng1", domain="ldap.test")
 
-        netgroup_nested = provider.netgroup("nested_group").add()
-        netgroup_nested.add_member(host="testhost2", user="ng2", domain="ldap.test")
-        netgroup_nested.add_member(ng="group")
-        client.sssd.start()
+    netgroup_nested = provider.netgroup("nested_group").add()
+    netgroup_nested.add_member(host="testhost2", user="ng2", domain="ldap.test")
+    netgroup_nested.add_member(ng="group")
+    client.sssd.start()
 
-        result = client.tools.getent.netgroup("nested_group")
-        assert result is not None
-        assert "(testhost2, ng2, ldap.test)" in result.members
-        assert "(testhost1, ng1, ldap.test)" in result.members
+    result = client.tools.getent.netgroup("nested_group")
+    assert result is not None
+    assert "(testhost2, ng2, ldap.test)" in result.members
+    assert "(testhost1, ng1, ldap.test)" in result.members
 
 
 @pytest.mark.importance("low")
@@ -173,27 +174,28 @@ def test_netgroup__lookup_nested_groups(client: Client, provider: GenericProvide
         1. Netgroup is found and both netgroups and users are members
     :customerscenario: False
     """
-    if isinstance(provider, (LDAP, Samba, AD)):
-        for id in [1, 2, 3]:
-            provider.user(f"ng{id}").add()
+    if not isinstance(provider, (LDAP, Samba, AD)):
+        raise ValueError("IPA does not support domain in netgroups")
+    for id in [1, 2, 3]:
+        provider.user(f"ng{id}").add()
 
-        netgroup = provider.netgroup("group").add()
-        netgroup.add_member(host="testhost1", user="ng1", domain="ldap.test")
+    netgroup = provider.netgroup("group").add()
+    netgroup.add_member(host="testhost1", user="ng1", domain="ldap.test")
 
-        nested_netgroup = provider.netgroup("nested_netgroup").add()
-        nested_netgroup.add_member(ng=netgroup)
-        nested_netgroup.add_member(host="testhost2", user="ng2", domain="ldap.test")
-        nested_netgroup.add_member(user="ng3")
+    nested_netgroup = provider.netgroup("nested_netgroup").add()
+    nested_netgroup.add_member(ng=netgroup)
+    nested_netgroup.add_member(host="testhost2", user="ng2", domain="ldap.test")
+    nested_netgroup.add_member(user="ng3")
 
-        netgroup.add_member(ng=nested_netgroup)
+    netgroup.add_member(ng=nested_netgroup)
 
-        client.sssd.start()
+    client.sssd.start()
 
-        result = client.tools.getent.netgroup("nested_netgroup")
-        assert result is not None
-        assert "(testhost1,ng1,ldap.test)" in result.members
-        assert "(-,ng3,)" in result.members
-        assert "(testhost2,ng2,ldap.test)" in result.members
+    result = client.tools.getent.netgroup("nested_netgroup")
+    assert result is not None
+    assert "(testhost1,ng1,ldap.test)" in result.members
+    assert "(-,ng3,)" in result.members
+    assert "(testhost2,ng2,ldap.test)" in result.members
 
 
 @pytest.mark.parametrize(
@@ -219,22 +221,23 @@ def test_netgroup__lookup_nested_groups_with_host_and_domain_values_present(
         1. Member is present in the "nested_group"
     :customerscenario: False
     """
-    if isinstance(provider, (LDAP, Samba, AD)):
-        for id in [1, 2]:
-            provider.user(f"ng{id}").add()
+    if not isinstance(provider, (LDAP, Samba, AD)):
+        raise ValueError("IPA does not support domain in netgroups")
+    for id in [1, 2]:
+        provider.user(f"ng{id}").add()
 
-        netgroup_group = provider.netgroup("group").add()
-        netgroup_group.add_member(host="testhost1", user="ng1", domain="ldap.test")
+    netgroup_group = provider.netgroup("group").add()
+    netgroup_group.add_member(host="testhost1", user="ng1", domain="ldap.test")
 
-        netgroup_nested = provider.netgroup("nested_group").add()
-        netgroup_nested.add_member(host="testhost2", user="ng2", domain="ldap.test")
-        if domain == "host.ldap.test":
-            netgroup_nested.add_member(host=user, domain=domain)
-        else:
-            netgroup_nested.add_member(user=user)
+    netgroup_nested = provider.netgroup("nested_group").add()
+    netgroup_nested.add_member(host="testhost2", user="ng2", domain="ldap.test")
+    if domain == "host.ldap.test":
+        netgroup_nested.add_member(host=user, domain=domain)
+    else:
+        netgroup_nested.add_member(user=user)
 
-        client.sssd.start()
+    client.sssd.start()
 
-        result = client.tools.getent.netgroup("nested_group")
-        assert result is not None
-        assert expected in result.members
+    result = client.tools.getent.netgroup("nested_group")
+    assert result is not None
+    assert expected in result.members

From fce94aec3f335cbe33c509b14e389b9df0748744 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 21 Nov 2024 09:16:09 +0100
Subject: [PATCH 107/129] ldap_child: make sure invalid krb5 context is not
 used
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves: https://github.com/SSSD/sssd/issues/7715

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
---
 src/util/sss_krb5.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index aa3b5b96ef8..6b6dd2069ec 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -45,6 +45,10 @@ const char *sss_printable_keytab_name(krb5_context ctx, const char *keytab_name)
         return keytab_name;
     }
 
+    if (ctx == NULL) {
+        return "-unknown-";
+    }
+
     if (krb5_kt_default_name(ctx, buff, sizeof(buff)) != 0) {
         return "-default keytab-";
     }
@@ -1122,8 +1126,9 @@ krb5_error_code sss_krb5_init_context(krb5_context *context)
 {
     krb5_error_code kerr;
     const char *msg;
+    krb5_context ctx;
 
-    kerr = krb5_init_context(context);
+    kerr = krb5_init_context(&ctx);
     if (kerr != 0) {
         /* It is safe to call (sss_)krb5_get_error_message() with NULL as first
          * argument. */
@@ -1132,6 +1137,8 @@ krb5_error_code sss_krb5_init_context(krb5_context *context)
               "Failed to init Kerberos context [%s]\n", msg);
         sss_log(SSS_LOG_CRIT, "Failed to init Kerberos context [%s]\n", msg);
         sss_krb5_free_error_message(NULL, msg);
+    } else {
+        *context = ctx;
     }
 
     return kerr;

From 7514309bb361c8aea4f5ac8fef68f1a50f1a3fe1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20V=C3=A1vra?= <jvavra@redhat.com>
Date: Mon, 25 Nov 2024 12:59:51 +0100
Subject: [PATCH 108/129] Tests: Update sst to rhel-sst-idm-sssd for polarion.

Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
---
 src/tests/polarion.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tests/polarion.yaml b/src/tests/polarion.yaml
index 75b1ccb96e9..8b684fcc029 100644
--- a/src/tests/polarion.yaml
+++ b/src/tests/polarion.yaml
@@ -22,7 +22,7 @@ testcase:
     status:
       default: "approved"
     subsystemteam:
-      default: "sst_idm_sssd"
+      default: "rhel-sst-idm-sssd"
     upstream:
       default: "yes"
     automation_script:

From 0bb13645168864ca9eb7097cad063e1bfa4834cf Mon Sep 17 00:00:00 2001
From: Justin Stephenson <jstephen@redhat.com>
Date: Mon, 18 Nov 2024 15:15:41 -0500
Subject: [PATCH 109/129] analyzer: fix two crashes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OSError from 'sss_analyze error list'

PermissionError from 'sss_analyze request list' run without sudo

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/tools/analyzer/source_files.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/tools/analyzer/source_files.py b/src/tools/analyzer/source_files.py
index 0cadf99f035..1825d2d7c97 100644
--- a/src/tools/analyzer/source_files.py
+++ b/src/tools/analyzer/source_files.py
@@ -31,9 +31,8 @@ def __iter__(self):
                 with open(files) as file:
                     for line in file:
                         yield line
-            except FileNotFoundError as err:
-                logger.warning("Could not find domain log file, skipping")
-                logger.warning(err)
+            except Exception as e:
+                logger.warning(e)
                 continue
 
     def resolve_path(self, path):
@@ -70,7 +69,6 @@ def set_component(self, component, child):
         elif component == self.Component.BE:
             domains = self.get_domain_logfiles(child)
             if not domains:
-                raise IOError
-            # error: No domains found?
+                return
             for dom in domains:
                 self.log_files.append(dom)

From e4b26042a5696c10ee0616a34c39f3539ca5ae34 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 18 Nov 2024 11:22:32 +0100
Subject: [PATCH 110/129] dyndns: collect nsupdate debug output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It looks like in current code the assumption is that the nsupdate
command can just send its debug output into the backend log by
duplicating the file descriptor. This won't work since the logs file is
opened with O_CLOEXEC so that it is closed when nsupdate is started.

Additionally it is questionable if this approach is a good idea because
it would lead to a random intermixing of debug information. This patch
collects the output on strderr of nsupdate separately and adds it into
the backend log similar to the input send to nsupdate.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 Makefile.am               |   3 +-
 src/providers/be_dyndns.c | 150 +++++++++++++++++++++++++-------------
 2 files changed, 102 insertions(+), 51 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 1b9484e1c66..cfc7f69c896 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2890,7 +2890,8 @@ dyndns_tests_SOURCES = \
      $(SSSD_RESOLV_OBJ) \
      src/tests/cmocka/common_mock_be.c \
      src/tests/cmocka/test_dyndns.c \
-     src/providers/data_provider_opts.c
+     src/providers/data_provider_opts.c \
+     src/util/child_common.c
 dyndns_tests_CFLAGS = \
     $(AM_CFLAGS) \
     $(CMOCKA_CFLAGS) \
diff --git a/src/providers/be_dyndns.c b/src/providers/be_dyndns.c
index e6fa7dfd69e..8274f10cf9a 100644
--- a/src/providers/be_dyndns.c
+++ b/src/providers/be_dyndns.c
@@ -793,9 +793,14 @@ nsupdate_get_addrs_recv(struct tevent_req *req,
  * a timeout or when the child finishes operation.
  */
 struct nsupdate_child_state {
+    struct tevent_context *ev;
     int pipefd_to_child;
+    int pipefd_from_child;
     struct tevent_timer *timeout_handler;
     struct sss_child_ctx_old *child_ctx;
+    bool read_done;
+    bool process_finished;
+    errno_t result;
 
     int child_status;
 };
@@ -810,11 +815,13 @@ nsupdate_child_handler(int child_status,
                        void *pvt);
 
 static void nsupdate_child_stdin_done(struct tevent_req *subreq);
+void nsupdate_child_read_done(struct tevent_req *subreq);
 
 static struct tevent_req *
 nsupdate_child_send(TALLOC_CTX *mem_ctx,
                     struct tevent_context *ev,
                     int pipefd_to_child,
+                    int pipefd_from_child,
                     pid_t child_pid,
                     char *child_stdin)
 {
@@ -829,7 +836,13 @@ nsupdate_child_send(TALLOC_CTX *mem_ctx,
         close(pipefd_to_child);
         return NULL;
     }
+
+    state->ev = ev;
     state->pipefd_to_child = pipefd_to_child;
+    state->pipefd_from_child = pipefd_from_child;
+    state->read_done = false;
+    state->process_finished = false;
+    state->result = ERR_DYNDNS_FAILED;
 
     /* Set up SIGCHLD handler */
     ret = child_handler_setup(ev, child_pid, nsupdate_child_handler, req,
@@ -903,6 +916,8 @@ nsupdate_child_stdin_done(struct tevent_req *subreq)
 
     ret = write_pipe_recv(subreq);
     talloc_zfree(subreq);
+    PIPE_FD_CLOSE(state->pipefd_to_child);
+
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "Sending nsupdate data failed [%d]: %s\n",
               ret, sss_strerror(ret));
@@ -910,8 +925,56 @@ nsupdate_child_stdin_done(struct tevent_req *subreq)
         return;
     }
 
-    PIPE_FD_CLOSE(state->pipefd_to_child);
+    subreq = read_pipe_send(state, state->ev, state->pipefd_from_child);
+    if (subreq == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "read_pipe_send failed.\n");
+        tevent_req_error(req, ERR_DYNDNS_FAILED);
+        return;
+    }
+    tevent_req_set_callback(subreq, nsupdate_child_read_done, req);
+
+    /* Now either wait for the timeout to fire or the child
+     * to finish
+     */
+}
 
+void nsupdate_child_read_done(struct tevent_req *subreq)
+{
+    errno_t ret;
+    uint8_t *buf = NULL;
+    ssize_t buf_len = 0;
+    struct tevent_req *req =
+            tevent_req_callback_data(subreq, struct tevent_req);
+    struct nsupdate_child_state *state =
+            tevent_req_data(req, struct nsupdate_child_state);
+
+    talloc_zfree(state->timeout_handler);
+
+    ret = read_pipe_recv(subreq, state, &buf, &buf_len);
+    talloc_zfree(subreq);
+    PIPE_FD_CLOSE(state->pipefd_from_child);
+    if (ret != EOK) {
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    if (buf_len != 0) {
+        DEBUG(SSSDBG_TRACE_LIBS, "--- nsupdate output start---\n"
+                                 "%.*s\n"
+                                 "--- nsupdate output end---\n",
+                                 (int) buf_len, buf);
+    } else {
+        DEBUG(SSSDBG_TRACE_LIBS, "No output from nsupdate.\n");
+    }
+
+    state->read_done = true;
+    if (state->process_finished) {
+        if (state->result == EOK) {
+            tevent_req_done(req);
+        } else {
+            tevent_req_error(req, state->result);
+        }
+    }
     /* Now either wait for the timeout to fire or the child
      * to finish
      */
@@ -927,23 +990,29 @@ nsupdate_child_handler(int child_status,
             tevent_req_data(req, struct nsupdate_child_state);
 
     state->child_status = child_status;
+    state->result = EOK;
 
     if (WIFEXITED(child_status) && WEXITSTATUS(child_status) != 0) {
         DEBUG(SSSDBG_OP_FAILURE,
               "Dynamic DNS child failed with status [%d]\n", child_status);
-        tevent_req_error(req, ERR_DYNDNS_FAILED);
-        return;
+        state->result = ERR_DYNDNS_FAILED;
     }
 
     if (WIFSIGNALED(child_status)) {
         DEBUG(SSSDBG_OP_FAILURE,
               "Dynamic DNS child was terminated by signal [%d]\n",
                WTERMSIG(child_status));
-        tevent_req_error(req, ERR_DYNDNS_FAILED);
-        return;
+        state->result = ERR_DYNDNS_FAILED;
     }
 
-    tevent_req_done(req);
+    state->process_finished = true;
+    if (state->read_done) {
+        if (state->result == EOK) {
+            tevent_req_done(req);
+        } else {
+            tevent_req_error(req, state->result);
+        }
+    }
 }
 
 static errno_t
@@ -969,9 +1038,9 @@ struct be_nsupdate_state {
 };
 
 static void be_nsupdate_done(struct tevent_req *subreq);
-static char **be_nsupdate_args(TALLOC_CTX *mem_ctx,
-                               enum be_nsupdate_auth auth_type,
-                               bool force_tcp);
+static const char **be_nsupdate_args(TALLOC_CTX *mem_ctx,
+                                     enum be_nsupdate_auth auth_type,
+                                     bool force_tcp);
 
 struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
                                     struct tevent_context *ev,
@@ -980,13 +1049,13 @@ struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
                                     bool force_tcp)
 {
     int pipefd_to_child[2] = PIPE_INIT;
+    int pipefd_from_child[2] = PIPE_INIT;
     pid_t child_pid;
     errno_t ret;
     struct tevent_req *req = NULL;
     struct tevent_req *subreq = NULL;
     struct be_nsupdate_state *state;
-    char **args;
-    int debug_fd;
+    const char **args;
 
     req = tevent_req_create(mem_ctx, &state, struct be_nsupdate_state);
     if (req == NULL) {
@@ -1001,49 +1070,36 @@ struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
               "pipe failed [%d][%s].\n", ret, strerror(ret));
         goto done;
     }
+    ret = pipe(pipefd_from_child);
+    if (ret == -1) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "pipe (from) failed [%d][%s].\n", ret, strerror(ret));
+        goto done;
+    }
+
+    args = be_nsupdate_args(state, auth_type, force_tcp);
+    if (args == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
 
     child_pid = fork();
 
     if (child_pid == 0) { /* child */
-        PIPE_FD_CLOSE(pipefd_to_child[1]);
-        ret = dup2(pipefd_to_child[0], STDIN_FILENO);
-        if (ret == -1) {
-            ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "dup2 failed [%d][%s].\n", ret, strerror(ret));
-            goto done;
-        }
-
-        if (debug_level >= SSSDBG_TRACE_LIBS) {
-            debug_fd = get_fd_from_debug_file();
-            ret = dup2(debug_fd, STDERR_FILENO);
-            if (ret == -1) {
-                ret = errno;
-                DEBUG(SSSDBG_MINOR_FAILURE,
-                    "dup2 failed [%d][%s].\n", ret, strerror(ret));
-                /* stderr is not fatal */
-            }
-        }
-
-        args = be_nsupdate_args(state, auth_type, force_tcp);
-        if (args == NULL) {
-            ret = ENOMEM;
-            goto done;
-        }
-
-        errno = 0;
-        execv(NSUPDATE_PATH, args);
-        /* The child should never end up here */
-        ret = errno;
+        exec_child_ex(state, pipefd_to_child, pipefd_from_child, NSUPDATE_PATH,
+                      NULL, args, true, STDIN_FILENO, STDERR_FILENO);
         DEBUG(SSSDBG_CRIT_FAILURE, "execv failed [%d][%s].\n", ret, strerror(ret));
         goto done;
     } else if (child_pid > 0) { /* parent */
         PIPE_FD_CLOSE(pipefd_to_child[0]);
+        PIPE_FD_CLOSE(pipefd_from_child[1]);
 
         /* the nsupdate_child request now owns the pipefd and is responsible
          * for closing it
          */
         subreq = nsupdate_child_send(state, ev, pipefd_to_child[1],
+                                     pipefd_from_child[0],
                                      child_pid, nsupdate_msg);
         if (subreq == NULL) {
             ret = ERR_DYNDNS_FAILED;
@@ -1067,25 +1123,19 @@ struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
     return req;
 }
 
-static char **
+static const char **
 be_nsupdate_args(TALLOC_CTX *mem_ctx,
                  enum be_nsupdate_auth auth_type,
                  bool force_tcp)
 {
-    char **argv;
+    const char **argv;
     int argc = 0;
 
-    argv = talloc_zero_array(mem_ctx, char *, 6);
+    argv = talloc_zero_array(mem_ctx, const char *, 6);
     if (argv == NULL) {
         return NULL;
     }
 
-    argv[argc] = talloc_strdup(argv, NSUPDATE_PATH);
-    if (argv[argc] == NULL) {
-        goto fail;
-    }
-    argc++;
-
     switch (auth_type) {
     case BE_NSUPDATE_AUTH_NONE:
         DEBUG(SSSDBG_FUNC_DATA, "nsupdate auth type: none\n");

From 58a2fee59914eea5130fd995315149f1b15fd5a8 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu@redhat.com>
Date: Sat, 2 Nov 2024 02:40:36 -0400
Subject: [PATCH 111/129] tests: adding system/tests/readme.rst as a quick
 primer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
---
 src/tests/system/tests/readme.rst | 115 ++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 src/tests/system/tests/readme.rst

diff --git a/src/tests/system/tests/readme.rst b/src/tests/system/tests/readme.rst
new file mode 100644
index 00000000000..9633f967f65
--- /dev/null
+++ b/src/tests/system/tests/readme.rst
@@ -0,0 +1,115 @@
+SSSD System Tests
+=================
+
+Tests are written in Python using our `SSSD <https://tests.sssd.io/en/latest/>`__ framework and `pytest <https://docs.pytest.org/en/stable/>`__ framework and most notably `pytest mh <https://github.com/next-actions/pytest-mh>`__  plug-in amongst others. For more information please visit our `SSSD framework wiki <https://tests.sssd.io/en/latest/>`__.
+
+.. note::
+
+    We are in the progress of overhauling our tests, with the emphasis on providing excellent test coverage, clear concise documentation, consistent and maintainable test code. This system test folder, does contain more types of test than the folder name suggests. Sanity and integration tests are included and will have a pytest marker indicating the difference.
+
+Test Categories
+***************
+Tests can be written for a specific identity provider; IPA, LDAP, KRB, Samba or AD. When possible, they should be written using a generic provider which will execute the test against all providers. Tests are organized by user scenarios, depending on the case, they can be organized by providers or feature.
+
+* test_authentication.py, contains password policies tests, and tests with different auth mechanisms password, GSSAPI or certificates.
+* test_passkey.py, contains authentication tests, using virtual passkeys.
+* test_smartcards.py, contains authentication tests, using virtual smart cards.
+* test_identity.py, contains tests resolving users, groups, group memberships and the object attributes.
+* test_lookup.py, similar to identity tests but the tests focus on the client configuration.
+* test_netgroup.py, contains all tests related to netgroups.
+* test_access_control.py, contains simple, LDAP or AD filter access control tests.
+* test_gpo.py, contains access control tests managed by group policy objects (gpo) in AD.
+* test_cache.py, contains LDB cache tests.
+* test_memcache.py, contains in-memory cache tests.
+* test_files.py, legacy files provider tests.
+* test_proxy.py, proxy provider tests.
+* test_failover.py, any provider resolution and connectivity tests.
+* test_ldap.py, any test that is specific to LDAP.
+* test_ad.py, any test that is specific to AD.
+* test_ipa.py, any test that is specific to IPA.
+* test_ipa_trust.py, any IPA trust test
+* test_krb.py, any test that is specific to kerberos.
+* test_service.py, any test that is checking the SSSD service, process and child processes.
+* test_kcm.py, contains kerberos cache manager tests.
+* test_autofs.py, contains auto file system (autofs) or automount tests.
+* test_sudo.py, contains sudo privilege escalation tests.
+* test_tools.py, contains any cli tool tests, like sss_obfuscate.
+* test_sss_override.py, contains sss_override CLI tests.
+* test_sssctl.py, contains sssctl CLI tests.
+* test_infopipe.py, contains any d-bus infopipe tests.
+* test_python_modules.py, contains integration tests for sss python modules.
+* test_services.py, contains tests specific to the SSSD and processes.
+* test_responders.py, contains responders tests, NSS, PAM and others.
+
+.. note::
+
+    Samba Active Directory is the only AD topology used when testing upstream. Please use 'AnyAD' topology if early testing is needed.
+
+Test Scope
+**********
+
+Tests are written to check a specific user scenario, parameter, issue or bug. Often it will be faster to merge tests into one, or when test cases overlap. For simplicity, every test case is small and covers a specific case.
+
+Test Naming
+***********
+
+Pytest requires that tests names and file names are pre-fixed with *test_*. Test names have been standardize to then contain the file name and describe what the test code does and may not match related bugs, issues or tickets.
+
+Docstrings
+**********
+
+Each test is required to contain the following docstring fields.
+
+* title: Required, descriptive abbreviated test name, the name should give you a good idea of what it covers.
+* description: Optional, provide more detail about the test if necessary.
+* setup: Required, incremented list of steps needed before the test scenario can be executed.
+* steps: Required, incremented list of the test steps, beginning with the test scenario.
+* expectedresults: Required, incremented list of the results, matching the chronological order of test steps.
+* customerscenario: Required, true or false.
+* requirement: Required, test requirement or None.
+
+.. code-block::
+
+    def test_authentication__with_default_settings(
+        client: Client, provider: GenericProvider, method, str, sssd_service_user: str):
+        """
+        :title: Authenticate user with default settings
+        :setup:
+            1. Create user
+            2. Start SSSD
+        :steps:
+            1. Authenticate user with correct password
+            2. Authenticate user with incorrect password
+        :expectedresults:
+            1. Authentication is successful
+            2. Authentication is unsuccessful
+        :customerscenario: False
+        """
+        provider.user("user1").add(password="Secret123")
+
+        client.sssd.start(service_user=sssd_service_user)
+
+        assert client.auth.parametrize(method).password("user1", "Secret123"), "User failed login!"
+        assert not client.auth.parametrize(method).password(
+            "user1", "NOTSecret123"
+        ), "User logged in with an invalid password!"
+
+
+.. note::
+
+    Test code should follow the steps in order, making it easy to follow. Strip anything that is not relevant to the test, like extra configuration parameters, unused users or groups. Exceptions are fine, kindly comment the reason. Generally, language should be clear and short enough to comprehend the case but should be reduced if it becomes overly complicated with detail.
+
+Parameterization
+****************
+
+    Tests can be parameterized to reduce the volume of test cases. In the following example, a total of four scenarios will be executed from this single test: 'su:root, su:sssd, ssh:root, ssh:sssd'. Previously, four test cases would have been written to provide the same coverage.
+
+.. code-block::
+
+    @pytest.mark.topology(KnownTopologyGroup.AnyProvider)
+    @pytest.mark.parametrize("method", ["su", "ssh"])
+    @pytest.mark.parametrize("sssd_service_user", ("root", "sssd"))
+
+Look for opportunities to reduce the amount of test cases and test code to ease maintenance.
+
+For more detail in our coding styles and concepts, please visit `writing system tests <https://tests.sssd.io/en/latest/concepts.html>`__ page.

From 6040510803503d8da08c17d7177c0bed744b688c Mon Sep 17 00:00:00 2001
From: aborah-sudo <aborah@redhat.com>
Date: Thu, 21 Nov 2024 10:49:16 +0530
Subject: [PATCH 112/129] Tests: SSSD fails to store users if any of the
 requested attribute is empty
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SSSD fails to store users if any of the requested attribute is empty

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
---
 src/tests/system/tests/test_ldap.py | 36 +++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/src/tests/system/tests/test_ldap.py b/src/tests/system/tests/test_ldap.py
index 251663e5f65..26ff9b8369e 100644
--- a/src/tests/system/tests/test_ldap.py
+++ b/src/tests/system/tests/test_ldap.py
@@ -502,3 +502,39 @@ def test_ldap__password_change_no_grace_logins_left(
 
     rc, _, _, _ = client.auth.parametrize(method).password_with_output("user1", "Secret123")
     assert rc == expected, err_msg
+
+
+@pytest.mark.importance("low")
+@pytest.mark.topology(KnownTopology.LDAP)
+def test_ldap__empty_attribute(client: Client, ldap: LDAP):
+    """
+    :title: SSSD fails to store users if any of the requested attribute is empty
+    :setup:
+        1. Disable Syntax Checking
+        2. Add a User
+        3. Make home attribute of user empty
+        4. Add Groups
+        5. Start SSSD
+    :steps:
+        1. User exists
+        2. Groups are resolved
+        3. User should be able to log in
+    :expectedresults:
+        1. Id look up should success
+        2. Group look up should success
+        3. User log in should success
+    :customerscenario: True
+    """
+    ldap.ldap.modify("cn=config", replace={"nsslapd-syntaxcheck": "off"})
+    user = ldap.user("emp_user").add(password="Secret123")
+    user.modify(home = "")
+
+    ldap.group("Group_1").add().add_member(member=user)
+    ldap.group("Group_2").add().add_member(member=user)
+
+    client.sssd.start()
+
+    assert client.tools.id("emp_user") is not None
+    for grp in ["Group_1", "Group_2"]:
+        assert client.tools.getent.group(grp) is not None
+    assert client.auth.ssh.password(user.name, "Secret123"), "User login failed!"

From 098105486cd014717cbb055195b9f879dbce63ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20V=C3=A1vra?= <jvavra@redhat.com>
Date: Mon, 2 Dec 2024 09:06:12 +0100
Subject: [PATCH 113/129] Tests: Add ssh to services for authentication with
 ssh tests.

This fixes mh critical tests that are failing.

Reviewed-by: Shridhar Gadekar <sgadekar@redhat.com>
---
 src/tests/system/tests/test_authentication.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/tests/system/tests/test_authentication.py b/src/tests/system/tests/test_authentication.py
index 4f25228a3d4..1b57273a8f2 100644
--- a/src/tests/system/tests/test_authentication.py
+++ b/src/tests/system/tests/test_authentication.py
@@ -38,7 +38,8 @@ def test_authentication__with_default_settings(
     :customerscenario: False
     """
     provider.user("user1").add(password="Secret123")
-
+    if method == "ssh" and "ssh" not in client.sssd.sssd["services"]:
+        client.sssd.sssd["services"] = "nss, pam, ssh"
     client.sssd.start(service_user=sssd_service_user)
 
     assert client.auth.parametrize(method).password("user1", "Secret123"), "User failed login!"
@@ -79,7 +80,8 @@ def test_authentication__default_settings_when_the_provider_is_offline(
     correct = "Secret123"
     wrong = "Wrong123"
     provider.user(user).add(password=correct)
-
+    if method == "ssh" and "ssh" not in client.sssd.sssd["services"]:
+        client.sssd.sssd["services"] = "nss, pam, ssh"
     client.sssd.domain["cache_credentials"] = "True"
     client.sssd.domain["krb5_store_password_if_offline"] = "True"
     client.sssd.pam["offline_credentials_expiration"] = "0"

From 7b855ab92097ceef94baa4060b2691b09edb6a79 Mon Sep 17 00:00:00 2001
From: aborah-sudo <aborah@redhat.com>
Date: Tue, 3 Dec 2024 05:40:07 +0530
Subject: [PATCH 114/129] Tests: Fix python black formation error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Would reformat system/tests/test_ldap.py

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
---
 src/tests/system/tests/test_ldap.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tests/system/tests/test_ldap.py b/src/tests/system/tests/test_ldap.py
index 26ff9b8369e..90acb497f76 100644
--- a/src/tests/system/tests/test_ldap.py
+++ b/src/tests/system/tests/test_ldap.py
@@ -527,7 +527,7 @@ def test_ldap__empty_attribute(client: Client, ldap: LDAP):
     """
     ldap.ldap.modify("cn=config", replace={"nsslapd-syntaxcheck": "off"})
     user = ldap.user("emp_user").add(password="Secret123")
-    user.modify(home = "")
+    user.modify(home="")
 
     ldap.group("Group_1").add().add_member(member=user)
     ldap.group("Group_2").add().add_member(member=user)

From fe26a930852b85b128ca8e3fbf9dfa72536969ea Mon Sep 17 00:00:00 2001
From: Tomas Halman <thalman@redhat.com>
Date: Wed, 23 Oct 2024 17:26:14 +0200
Subject: [PATCH 115/129] Add DoT support for DNS updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DNS-over-TLS is a new standard for encrypting DNS traffic.

SSSD does not implement the DoT itself but relies on other
components of the system. This modification allows as to set
a DoT for dynamic DNS updates

:config: the `dyndns_server` option is extended so it can
  be in form of URI (dns+tls://1.2.3.4:853#servername).
  New set of options `dyndns_dot_cacert`,
  `dyndns_dot_cert` and `dyndns_dot_key` allows to configure
  DNS-over-TLS communication.

:relnote: The DoT for dynamic DNS updates is supported now.
  It requires new version of `nsupdate` from BIND 9.19+.

Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
 src/config/SSSDConfig/sssdoptions.py |   3 +
 src/config/SSSDConfigTest.py         |   6 +
 src/config/cfg_rules.ini             |   3 +
 src/config/etc/sssd.api.conf         |   3 +
 src/man/sssd-ad.5.xml                |  68 +++++++++++-
 src/man/sssd-ipa.5.xml               |  68 +++++++++++-
 src/providers/ad/ad_opts.c           |   3 +
 src/providers/be_dyndns.c            | 159 ++++++++++++++++++++++++---
 src/providers/be_dyndns.h            |  23 +++-
 src/providers/ipa/ipa_opts.c         |   3 +
 src/providers/ldap/sdap_dyndns.c     |  54 ++++++---
 src/tests/cmocka/test_dyndns.c       |  21 ++--
 src/tests/cmocka/test_utils.c        |  60 ++++++++++
 src/util/child_common.c              |  28 +++++
 src/util/util.c                      |  80 ++++++++++++++
 src/util/util.h                      |  16 +++
 16 files changed, 556 insertions(+), 42 deletions(-)

diff --git a/src/config/SSSDConfig/sssdoptions.py b/src/config/SSSDConfig/sssdoptions.py
index 7eed403e4bd..88adcfbf28e 100644
--- a/src/config/SSSDConfig/sssdoptions.py
+++ b/src/config/SSSDConfig/sssdoptions.py
@@ -207,6 +207,9 @@ def __init__(self):
         'dyndns_force_tcp': _("Whether the nsupdate utility should default to using TCP"),
         'dyndns_auth': _("What kind of authentication should be used to perform the DNS update"),
         'dyndns_server': _("Override the DNS server used to perform the DNS update"),
+        'dyndns_dot_cacert': _("The file of the certificate authorities certificates for DoT"),
+        'dyndns_dot_cert': _("The certificate(s) file for authentication for the DoT transport"),
+        'dyndns_dot_key': _("The key file for authenticated encryption for the DoT transport"),
         'subdomain_enumerate': _('Control enumeration of trusted domains'),
         'subdomain_refresh_interval': _('How often should subdomains list be refreshed'),
         'subdomain_refresh_interval_offset': _('Maximum period deviation when refreshing the subdomain list'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 6087f6e085b..e67f47c5e5e 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -567,6 +567,9 @@ def testListOptions(self):
             'dyndns_force_tcp',
             'dyndns_auth',
             'dyndns_server',
+            'dyndns_dot_cacert',
+            'dyndns_dot_cert',
+            'dyndns_dot_key',
             'subdomain_enumerate',
             'override_gid',
             'case_sensitive',
@@ -928,6 +931,9 @@ def testRemoveProvider(self):
             'dyndns_force_tcp',
             'dyndns_auth',
             'dyndns_server',
+            'dyndns_dot_cacert',
+            'dyndns_dot_cert',
+            'dyndns_dot_key',
             'subdomain_enumerate',
             'override_gid',
             'case_sensitive',
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index 950eae630fb..920902209c5 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -443,6 +443,9 @@ option = dyndns_force_tcp
 option = dyndns_auth
 option = dyndns_auth_ptr
 option = dyndns_server
+option = dyndns_dot_cacert
+option = dyndns_dot_cert
+option = dyndns_dot_key
 
 # files provider specific options
 option = passwd_files
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 4377a1fc571..2ab4a92a29c 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -216,6 +216,9 @@ dyndns_update_ptr = bool, None, false
 dyndns_force_tcp = bool, None, false
 dyndns_auth = str, None, false
 dyndns_server = str, None, false
+dyndns_dot_cacert = str, None, false
+dyndns_dot_cert = str, None, false
+dyndns_dot_key = str, None, false
 
 # Special providers
 [provider/permit]
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 79724fff5da..67239917dd1 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -1328,12 +1328,26 @@ ad_gpo_map_deny = +my_pam_service
                         <para>
                             Setting this option makes sense for environments
                             where the DNS server is different from the identity
-                            server.
+                            server or when we use encrypted DNS.
+                        </para>
+                        <para>
+                           The parameter can be a simple string containing
+                           DNS name or IP address. It can also be an URI.
+                           The URI can look like
+                           <emphasis>dns://servername/</emphasis> or
+                           <emphasis>dns+tls://1.2.3.4:853#servername/</emphasis>.
+                        </para>
+                        <para>
+                            The second example enables DNS-over-TLS protocol for
+                            DNS updates. The nsupdate utility must support DoT -
+                            check the <emphasis>man nsupdate</emphasis> before
+                            enabling it in SSSD.
                         </para>
                         <para>
                             Please note that this option will be only used in
                             fallback attempt when previous attempt using
-                            autodetected settings failed.
+                            autodetected settings failed or when DNS-over-TLS
+                            is enabled.
                         </para>
                         <para>
                             Default: None (let nsupdate choose the server)
@@ -1356,6 +1370,56 @@ ad_gpo_map_deny = +my_pam_service
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>dyndns_dot_cacert (string)</term>
+                    <listitem>
+                        <para>
+                            This option specifies the file of the certificate
+                            authorities certificates (in PEM format) in order
+                            to verify the remote server TLS certificate when
+                            using  DoT.
+                        </para>
+                        <para>
+                            Default: None (use global certificate store)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_dot_cert (string)</term>
+                    <listitem>
+                        <para>
+                            This option sets the certificate(s) file for
+                            authentication for the DoT transport to the remote
+                            server. The certificate chain file is expected to
+                            be in PEM format.
+                        </para>
+                        <para>
+                            The <emphasis>dyndns_dot_cert</emphasis> and
+                            <emphasis>dyndns_dot_key</emphasis> options must be
+                            both set to achieve mutual TLS authentication.
+                        </para>
+                        <para>
+                            Default: None (Do not use TLS authentication)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_dot_key (string)</term>
+                    <listitem>
+                        <para>
+                            This option sets the key file for authenticated
+                            encryption for the DoT transport to the remote
+                            server. The private key file is expected to
+                            be in PEM format.
+                        </para>
+                        <para>
+                            Default: None (Do not use TLS authentication)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />
                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/homedir_substring.xml" />
 
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index 5adfaefcd7d..57a55bef961 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -321,12 +321,26 @@
                         <para>
                             Setting this option makes sense for environments
                             where the DNS server is different from the identity
-                            server.
+                            server or when we use encrypted DNS.
+                        </para>
+                        <para>
+                           The parameter can be a simple string containing
+                           DNS name or IP address. It can also be an URI.
+                           The URI can look like
+                           <emphasis>dns://servername/</emphasis> or
+                           <emphasis>dns+tls://1.2.3.4:853#servername/</emphasis>.
+                        </para>
+                        <para>
+                            The second example enables DNS-over-TLS protocol for
+                            DNS updates. The nsupdate utility must support DoT -
+                            check the <emphasis>man nsupdate</emphasis> before
+                            enabling it in SSSD.
                         </para>
                         <para>
                             Please note that this option will be only used in
                             fallback attempt when previous attempt using
-                            autodetected settings failed.
+                            autodetected settings failed or when DNS-over-TLS
+                            is enabled.
                         </para>
                         <para>
                             Default: None (let nsupdate choose the server)
@@ -349,6 +363,56 @@
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>dyndns_dot_cacert (string)</term>
+                    <listitem>
+                        <para>
+                            This option specifies the file of the certificate
+                            authorities certificates (in PEM format) in order
+                            to verify the remote server TLS certificate when
+                            using  DoT.
+                        </para>
+                        <para>
+                            Default: None (use global certificate store)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_dot_cert (string)</term>
+                    <listitem>
+                        <para>
+                            This option sets the certificate(s) file for
+                            authentication for the DoT transport to the remote
+                            server. The certificate chain file is expected to
+                            be in PEM format.
+                        </para>
+                        <para>
+                            The <emphasis>dyndns_dot_cert</emphasis> and
+                            <emphasis>dyndns_dot_key</emphasis> options must be
+                            both set to achieve mutual TLS authentication.
+                        </para>
+                        <para>
+                            Default: None (Do not use TLS authentication)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_dot_key (string)</term>
+                    <listitem>
+                        <para>
+                            This option sets the key file for authenticated
+                            encryption for the DoT transport to the remote
+                            server. The private key file is expected to
+                            be in PEM format.
+                        </para>
+                        <para>
+                            Default: None (Do not use TLS authentication)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
                 <varlistentry>
                     <term>ipa_access_order (string)</term>
                     <listitem>
diff --git a/src/providers/ad/ad_opts.c b/src/providers/ad/ad_opts.c
index e00777e68d5..a3dd0547b7a 100644
--- a/src/providers/ad/ad_opts.c
+++ b/src/providers/ad/ad_opts.c
@@ -325,6 +325,9 @@ struct dp_option ad_dyndns_opts[] = {
     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
     { "dyndns_auth_ptr", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_cacert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_cert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_key", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/be_dyndns.c b/src/providers/be_dyndns.c
index 8274f10cf9a..253b7da3b15 100644
--- a/src/providers/be_dyndns.c
+++ b/src/providers/be_dyndns.c
@@ -23,6 +23,7 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include <strings.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/ioctl.h>
@@ -30,6 +31,7 @@
 #include <net/if.h>
 #include <ifaddrs.h>
 #include <ctype.h>
+#include "util/debug.h"
 #include "util/util.h"
 #include "confdb/confdb.h"
 #include "util/child_common.h"
@@ -267,7 +269,8 @@ sss_iface_addr_list_get(TALLOC_CTX *mem_ctx, const char *ifname,
 
 static char *
 nsupdate_msg_add_fwd(char *update_msg, struct sss_iface_addr *addresses,
-                     const char *hostname, int ttl, uint8_t remove_af, bool update_per_family)
+                     const char *hostname, int ttl, uint8_t remove_af,
+                     bool update_per_family)
 {
     struct sss_iface_addr *new_record;
     char ip_addr[INET6_ADDRSTRLEN];
@@ -445,7 +448,7 @@ nsupdate_msg_add_realm_cmd(TALLOC_CTX *mem_ctx, const char *realm)
 
 static char *
 nsupdate_msg_create_common(TALLOC_CTX *mem_ctx, const char *realm,
-                           const char *servername)
+                           struct sss_parsed_dns_uri *server_uri)
 {
     char *realm_directive;
     char *update_msg;
@@ -462,14 +465,16 @@ nsupdate_msg_create_common(TALLOC_CTX *mem_ctx, const char *realm,
     /* The realm_directive would now either contain an empty string or be
      * completely empty so we don't need to add another newline here
      */
-    if (servername) {
+    if (server_uri) {
         DEBUG(SSSDBG_FUNC_DATA,
               "Creating update message for server [%s] and realm [%s].\n",
-               servername, realm);
+               server_uri->address, realm);
 
         /* Add the server, realm and headers */
-        update_msg = talloc_asprintf(tmp_ctx, "server %s\n%s",
-                                     servername, realm_directive);
+        update_msg = talloc_asprintf(tmp_ctx, "server %s %s\n%s",
+                                     server_uri->address,
+                                     sss_get_dns_port(server_uri),
+                                     realm_directive);
     } else if (realm != NULL) {
         DEBUG(SSSDBG_FUNC_DATA,
               "Creating update message for realm [%s].\n", realm);
@@ -496,7 +501,7 @@ nsupdate_msg_create_common(TALLOC_CTX *mem_ctx, const char *realm,
 
 errno_t
 be_nsupdate_create_fwd_msg(TALLOC_CTX *mem_ctx, const char *realm,
-                           const char *servername,
+                           struct sss_parsed_dns_uri *server_uri,
                            const char *hostname, const unsigned int ttl,
                            uint8_t remove_af, struct sss_iface_addr *addresses,
                            bool update_per_family,
@@ -514,7 +519,7 @@ be_nsupdate_create_fwd_msg(TALLOC_CTX *mem_ctx, const char *realm,
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) return ENOMEM;
 
-    update_msg = nsupdate_msg_create_common(tmp_ctx, realm, servername);
+    update_msg = nsupdate_msg_create_common(tmp_ctx, realm, server_uri);
     if (update_msg == NULL) {
         ret = ENOMEM;
         goto done;
@@ -542,7 +547,7 @@ be_nsupdate_create_fwd_msg(TALLOC_CTX *mem_ctx, const char *realm,
 
 errno_t
 be_nsupdate_create_ptr_msg(TALLOC_CTX *mem_ctx, const char *realm,
-                           const char *servername,
+                           struct sss_parsed_dns_uri *server_uri,
                            const char *hostname, const unsigned int ttl,
                            uint8_t remove_af, struct sss_iface_addr *addresses,
                            bool update_per_family,
@@ -560,7 +565,7 @@ be_nsupdate_create_ptr_msg(TALLOC_CTX *mem_ctx, const char *realm,
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) return ENOMEM;
 
-    update_msg = nsupdate_msg_create_common(tmp_ctx, realm, servername);
+    update_msg = nsupdate_msg_create_common(tmp_ctx, realm, server_uri);
     if (update_msg == NULL) {
         ret = ENOMEM;
         goto done;
@@ -1040,13 +1045,21 @@ struct be_nsupdate_state {
 static void be_nsupdate_done(struct tevent_req *subreq);
 static const char **be_nsupdate_args(TALLOC_CTX *mem_ctx,
                                      enum be_nsupdate_auth auth_type,
-                                     bool force_tcp);
+                                     bool force_tcp,
+                                     struct sss_parsed_dns_uri *server_uri,
+                                     const char *dot_cacert,
+                                     const char *dot_cert,
+                                     const char *dot_key);
 
 struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
                                     struct tevent_context *ev,
                                     enum be_nsupdate_auth auth_type,
                                     char *nsupdate_msg,
-                                    bool force_tcp)
+                                    bool force_tcp,
+                                    struct sss_parsed_dns_uri *server_uri,
+                                    const char *dot_cacert,
+                                    const char *dot_cert,
+                                    const char *dot_key)
 {
     int pipefd_to_child[2] = PIPE_INIT;
     int pipefd_from_child[2] = PIPE_INIT;
@@ -1078,7 +1091,8 @@ struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    args = be_nsupdate_args(state, auth_type, force_tcp);
+    args = be_nsupdate_args(state, auth_type, force_tcp,
+                            server_uri, dot_cacert, dot_cert, dot_key);
     if (args == NULL) {
         ret = ENOMEM;
         goto done;
@@ -1126,16 +1140,35 @@ struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
 static const char **
 be_nsupdate_args(TALLOC_CTX *mem_ctx,
                  enum be_nsupdate_auth auth_type,
-                 bool force_tcp)
+                 bool force_tcp,
+                 struct sss_parsed_dns_uri *server_uri,
+                 const char *dot_cacert,
+                 const char *dot_cert,
+                 const char *dot_key)
 {
     const char **argv;
     int argc = 0;
+    bool use_dot;
+    bool have_dot_cert;
+    bool have_dot_key;
 
-    argv = talloc_zero_array(mem_ctx, const char *, 6);
+    argv = talloc_zero_array(mem_ctx, const char *, 14);
     if (argv == NULL) {
         return NULL;
     }
 
+    if (!sss_is_valid_dns_scheme(server_uri)) {
+        sss_log(SSS_LOG_WARNING,
+                "Invalid DNS scheme in SSSD config file: %s, using dns://\n",
+                server_uri->scheme);
+        DEBUG(SSSDBG_MINOR_FAILURE,
+              "Invalid DNS scheme in SSSD config file: %s, using dns://\n",
+              server_uri->scheme);
+    }
+
+    use_dot = sss_is_dot_scheme(server_uri);
+    DEBUG(SSSDBG_FUNC_DATA, "nsupdate DoT: %i\n", use_dot);
+
     switch (auth_type) {
     case BE_NSUPDATE_AUTH_NONE:
         DEBUG(SSSDBG_FUNC_DATA, "nsupdate auth type: none\n");
@@ -1179,6 +1212,62 @@ be_nsupdate_args(TALLOC_CTX *mem_ctx,
         argc++;
     }
 
+    if (use_dot) {
+        DEBUG(SSSDBG_FUNC_DATA, "DoT option is set\n");
+        argv[argc] = talloc_strdup(argv, "-S");
+        if (argv[argc] == NULL) {
+            goto fail;
+        }
+        argc++;
+
+        /* DoT server name */
+        argv[argc] = talloc_strdup(argv, server_uri->host);
+        if (argv[argc] == NULL) {
+            goto fail;
+        }
+        argc++;
+        argv[argc] = talloc_strdup(argv, "-H");
+        if (argv[argc] == NULL) {
+            goto fail;
+        }
+        argc++;
+
+        /* DoT CA cert file */
+        if (dot_cacert != NULL && dot_cacert[0] != 0) {
+            argv[argc + 1] = talloc_strdup(argv, "-A");
+            argv[argc] = talloc_strdup(argv, dot_cacert);
+            if (argv[argc] == NULL || argv[argc+1] == NULL) {
+                goto fail;
+            }
+            argc += 2;
+        }
+
+        /* DoT cert and key must be set both or none */
+        have_dot_cert = (dot_cert != NULL && dot_cert[0] != 0);
+        have_dot_key = (dot_key != NULL && dot_key[0] != 0);
+        if (have_dot_key != have_dot_cert) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "The dyndns_dot_cert and dyndns_dot_key must be set both "
+                  "(or none of them)\n");
+            goto fail;
+        }
+        if (have_dot_cert && have_dot_key) {
+            /* we have both, key and cert file paths */
+            argv[argc + 1] = talloc_strdup(argv, "-E");
+            argv[argc] = talloc_strdup(argv, dot_cert);
+            if (argv[argc] == NULL || argv[argc+1] == NULL) {
+                goto fail;
+            }
+            argc += 2;
+
+            argv[argc + 1] = talloc_strdup(argv, "-K");
+            argv[argc] = talloc_strdup(argv, dot_key);
+            if (argv[argc] == NULL || argv[argc+1] == NULL) {
+                goto fail;
+            }
+            argc += 2;
+        }
+    }
     return argv;
 
 fail:
@@ -1259,6 +1348,9 @@ struct dp_option default_dyndns_opts[] = {
     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
     { "dyndns_auth_ptr", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_cacert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_cert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_key", DP_OPT_STRING, NULL_STRING, NULL_STRING },
 
     DP_OPTION_TERMINATOR
 };
@@ -1420,3 +1512,40 @@ errno_t sss_get_dualstack_addresses(TALLOC_CTX *mem_ctx,
     talloc_free(tmp_ctx);
     return ret;
 }
+
+bool
+sss_is_valid_dns_scheme(struct sss_parsed_dns_uri *uri)
+{
+    return
+        uri == NULL ||
+        uri->scheme == NULL || /* use default DNS scheme */
+        strcasecmp(uri->scheme, "dns") == 0 ||
+        strcasecmp(uri->scheme, "dns+tls") == 0;
+}
+
+bool
+sss_is_dot_scheme(struct sss_parsed_dns_uri *uri)
+{
+    return
+        uri != NULL &&
+        uri->scheme != NULL &&
+        strcasecmp(uri->scheme, "dns+tls") == 0;
+}
+
+const char *
+sss_get_dns_port(struct sss_parsed_dns_uri *uri)
+{
+    if (uri == NULL) {
+        return "53";
+    }
+
+    if (uri->port != NULL) {
+        return uri->port;
+    }
+
+    if (sss_is_dot_scheme(uri)) {
+        return "853";
+    }
+
+    return "53";
+}
diff --git a/src/providers/be_dyndns.h b/src/providers/be_dyndns.h
index 719c1394255..505b8fc5e12 100644
--- a/src/providers/be_dyndns.h
+++ b/src/providers/be_dyndns.h
@@ -27,6 +27,7 @@
 #define DP_DYNDNS_H_
 
 /* dynamic dns helpers */
+#include <stdbool.h>
 struct sss_iface_addr;
 
 typedef void (*nsupdate_timer_fn_t)(void *pvt);
@@ -60,6 +61,9 @@ enum dp_dyndns_opts {
     DP_OPT_DYNDNS_AUTH,
     DP_OPT_DYNDNS_AUTH_PTR,
     DP_OPT_DYNDNS_SERVER,
+    DP_OPT_DYNDNS_DOT_CACERT,
+    DP_OPT_DYNDNS_DOT_CERT,
+    DP_OPT_DYNDNS_DOT_KEY,
 
     DP_OPT_DYNDNS /* attrs counter */
 };
@@ -86,7 +90,7 @@ sss_iface_addr_list_as_str_list(TALLOC_CTX *mem_ctx,
 
 errno_t
 be_nsupdate_create_fwd_msg(TALLOC_CTX *mem_ctx, const char *realm,
-                           const char *servername,
+                           struct sss_parsed_dns_uri *server_uri,
                            const char *hostname, const unsigned int ttl,
                            uint8_t remove_af, struct sss_iface_addr *addresses,
                            bool update_per_family,
@@ -94,7 +98,7 @@ be_nsupdate_create_fwd_msg(TALLOC_CTX *mem_ctx, const char *realm,
 
 errno_t
 be_nsupdate_create_ptr_msg(TALLOC_CTX *mem_ctx, const char *realm,
-                           const char *servername,
+                           struct sss_parsed_dns_uri *server_uri,
                            const char *hostname, const unsigned int ttl,
                            uint8_t remove_af, struct sss_iface_addr *addresses,
                            bool update_per_family,
@@ -110,7 +114,11 @@ struct tevent_req *be_nsupdate_send(TALLOC_CTX *mem_ctx,
                                     struct tevent_context *ev,
                                     enum be_nsupdate_auth auth_type,
                                     char *nsupdate_msg,
-                                    bool force_tcp);
+                                    bool force_tcp,
+                                    struct sss_parsed_dns_uri *server_uri,
+                                    const char *dot_cacert,
+                                    const char *dot_cert,
+                                    const char *dot_key);
 errno_t be_nsupdate_recv(struct tevent_req *req, int *child_status);
 
 struct tevent_req * nsupdate_get_addrs_send(TALLOC_CTX *mem_ctx,
@@ -138,4 +146,13 @@ sss_iface_addr_get_next(struct sss_iface_addr *address);
 struct sockaddr *
 sss_iface_addr_get_address(struct sss_iface_addr *address);
 
+bool
+sss_is_valid_dns_scheme(struct sss_parsed_dns_uri *uri);
+
+bool
+sss_is_dot_scheme(struct sss_parsed_dns_uri *uri);
+
+const char *
+sss_get_dns_port(struct sss_parsed_dns_uri *uri);
+
 #endif /* DP_DYNDNS_H_ */
diff --git a/src/providers/ipa/ipa_opts.c b/src/providers/ipa/ipa_opts.c
index 62423f868e2..5bfd65a6717 100644
--- a/src/providers/ipa/ipa_opts.c
+++ b/src/providers/ipa/ipa_opts.c
@@ -69,6 +69,9 @@ struct dp_option ipa_dyndns_opts[] = {
     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
     { "dyndns_auth_ptr", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_cacert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_cert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_dot_key", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/sdap_dyndns.c b/src/providers/ldap/sdap_dyndns.c
index 3535fb42658..ef99d4666a1 100644
--- a/src/providers/ldap/sdap_dyndns.c
+++ b/src/providers/ldap/sdap_dyndns.c
@@ -48,7 +48,8 @@ struct sdap_dyndns_update_state {
 
     const char *hostname;
     const char *realm;
-    const char *servername;
+    struct sss_parsed_dns_uri *server_uri;
+    bool dot;
     int ttl;
 
     struct sss_iface_addr *addresses;
@@ -112,7 +113,8 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
     state->update_ptr = dp_opt_get_bool(opts, DP_OPT_DYNDNS_UPDATE_PTR);
     state->hostname = hostname;
     state->realm = realm;
-    state->servername = NULL;
+    state->server_uri = NULL;
+    state->dot = false;
     state->fallback_mode = false;
     state->ttl = ttl;
     state->be_res = be_ctx->be_res;
@@ -124,7 +126,11 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
     /* fallback servername is overridden by user option */
     conf_servername = dp_opt_get_string(opts, DP_OPT_DYNDNS_SERVER);
     if (conf_servername != NULL) {
-        state->servername = conf_servername;
+        ret = sss_parse_dns_uri(mem_ctx, conf_servername, &state->server_uri);
+        if (ret != EOK) {
+            goto done;
+        }
+        state->dot = sss_is_dot_scheme(state->server_uri);
     }
 
     if (ifname) {
@@ -324,20 +330,24 @@ sdap_dyndns_update_step(struct tevent_req *req)
 {
     errno_t ret;
     struct sdap_dyndns_update_state *state;
-    const char *servername;
+    struct sss_parsed_dns_uri *server_uri;
     const char *realm;
     struct tevent_req *subreq;
 
     state = tevent_req_data(req, struct sdap_dyndns_update_state);
 
-    servername = NULL;
+    server_uri = NULL;
     realm = NULL;
+    if (state->dot) {
+        /* in DoT we have to set the server */
+        state->fallback_mode = true;
+    }
     if (state->fallback_mode) {
-        servername = state->servername;
+        server_uri = state->server_uri;
         realm = state->realm;
     }
 
-    ret = be_nsupdate_create_fwd_msg(state, realm, servername,
+    ret = be_nsupdate_create_fwd_msg(state, realm, server_uri,
                                      state->hostname,
                                      state->ttl, state->remove_af,
                                      state->addresses,
@@ -352,7 +362,14 @@ sdap_dyndns_update_step(struct tevent_req *req)
     subreq = be_nsupdate_send(state, state->ev, state->auth_type,
                               state->update_msg,
                               dp_opt_get_bool(state->opts,
-                                              DP_OPT_DYNDNS_FORCE_TCP));
+                                              DP_OPT_DYNDNS_FORCE_TCP),
+                              state->server_uri,
+                              dp_opt_get_string(state->opts,
+                                                DP_OPT_DYNDNS_DOT_CACERT),
+                              dp_opt_get_string(state->opts,
+                                                DP_OPT_DYNDNS_DOT_CERT),
+                              dp_opt_get_string(state->opts,
+                                                DP_OPT_DYNDNS_DOT_KEY));
     if (subreq == NULL) {
         return EIO;
     }
@@ -409,20 +426,24 @@ sdap_dyndns_update_ptr_step(struct tevent_req *req)
 {
     errno_t ret;
     struct sdap_dyndns_update_state *state;
-    const char *servername;
+    struct sss_parsed_dns_uri *server_uri;
     const char *realm;
     struct tevent_req *subreq;
 
     state = tevent_req_data(req, struct sdap_dyndns_update_state);
 
-    servername = NULL;
+    server_uri = NULL;
     realm = NULL;
+    if (state->dot == true) {
+        /* in DoT we have to set the server */
+        state->fallback_mode = true;
+    }
     if (state->fallback_mode == true) {
-        servername = state->servername;
+        server_uri = state->server_uri;
         realm = state->realm;
     }
 
-    ret = be_nsupdate_create_ptr_msg(state, realm, servername,
+    ret = be_nsupdate_create_ptr_msg(state, realm, server_uri,
                                      state->hostname,
                                      state->ttl, state->remove_af,
                                      state->addresses,
@@ -438,7 +459,14 @@ sdap_dyndns_update_ptr_step(struct tevent_req *req)
     subreq = be_nsupdate_send(state, state->ev, state->auth_ptr_type,
                               state->update_msg,
                               dp_opt_get_bool(state->opts,
-                                              DP_OPT_DYNDNS_FORCE_TCP));
+                                              DP_OPT_DYNDNS_FORCE_TCP),
+                              state->server_uri,
+                              dp_opt_get_string(state->opts,
+                                                DP_OPT_DYNDNS_DOT_CACERT),
+                              dp_opt_get_string(state->opts,
+                                                DP_OPT_DYNDNS_DOT_CERT),
+                              dp_opt_get_string(state->opts,
+                                                DP_OPT_DYNDNS_DOT_KEY));
     if (subreq == NULL) {
         return EIO;
     }
diff --git a/src/tests/cmocka/test_dyndns.c b/src/tests/cmocka/test_dyndns.c
index 7526c16a86d..e3f8b7b35c2 100644
--- a/src/tests/cmocka/test_dyndns.c
+++ b/src/tests/cmocka/test_dyndns.c
@@ -35,6 +35,7 @@
 #include "tests/cmocka/common_mock.h"
 #include "tests/cmocka/common_mock_be.h"
 #include "src/providers/be_dyndns.h"
+#include "util/util.h"
 
 #define TESTS_PATH "tp_" BASE_FILE_STEM
 #define TEST_CONF_DB "test_dyndns_conf.ldb"
@@ -361,6 +362,7 @@ void dyndns_test_create_fwd_msg(void **state)
     errno_t ret;
     char *msg;
     struct sss_iface_addr *addrlist;
+    struct sss_parsed_dns_uri *uri;
     int i;
 
     check_leaks_push(dyndns_test_ctx);
@@ -411,14 +413,15 @@ void dyndns_test_create_fwd_msg(void **state)
     talloc_zfree(msg);
 
     /* fallback case realm and server */
-    ret = be_nsupdate_create_fwd_msg(dyndns_test_ctx, "North", "Winterfell",
+    sss_parse_dns_uri(dyndns_test_ctx, "Winterfell", &uri);
+    ret = be_nsupdate_create_fwd_msg(dyndns_test_ctx, "North", uri,
                                      "bran_stark",
                                      1234, DYNDNS_REMOVE_A | DYNDNS_REMOVE_AAAA,
                                      addrlist, true, &msg);
     assert_int_equal(ret, EOK);
 
     assert_string_equal(msg,
-                        "server Winterfell\n"
+                        "server Winterfell 53\n"
                         "realm North\n"
                         "update delete bran_stark. in A\n"
                         "update add bran_stark. 1234 in A 192.168.0.2\n"
@@ -446,14 +449,14 @@ void dyndns_test_create_fwd_msg(void **state)
     talloc_zfree(msg);
 
     /* just server */
-    ret = be_nsupdate_create_fwd_msg(dyndns_test_ctx, NULL, "Winterfell",
+    ret = be_nsupdate_create_fwd_msg(dyndns_test_ctx, NULL, uri,
                                      "bran_stark",
                                      1234, DYNDNS_REMOVE_A | DYNDNS_REMOVE_AAAA,
                                      addrlist, true, &msg);
     assert_int_equal(ret, EOK);
 
     assert_string_equal(msg,
-                        "server Winterfell\n"
+                        "server Winterfell 53\n"
                         "\n"
                         "update delete bran_stark. in A\n"
                         "update add bran_stark. 1234 in A 192.168.0.2\n"
@@ -492,6 +495,7 @@ void dyndns_test_create_fwd_msg(void **state)
     talloc_zfree(msg);
 
     talloc_free(addrlist);
+    talloc_free(uri);
     assert_true(check_leaks_pop(dyndns_test_ctx) == true);
 }
 
@@ -879,7 +883,8 @@ void dyndns_test_ok(void **state)
 
     req = be_nsupdate_send(tmp_ctx, dyndns_test_ctx->tctx->ev,
                            BE_NSUPDATE_AUTH_GSS_TSIG,
-                           discard_const("test message"), false);
+                           discard_const("test message"), false,
+                           false, NULL, NULL, NULL);
     assert_non_null(req);
     tevent_req_set_callback(req, dyndns_test_done, dyndns_test_ctx);
 
@@ -910,7 +915,8 @@ void dyndns_test_error(void **state)
 
     req = be_nsupdate_send(tmp_ctx, dyndns_test_ctx->tctx->ev,
                            BE_NSUPDATE_AUTH_GSS_TSIG,
-                           discard_const("test message"), false);
+                           discard_const("test message"), false,
+                           false, NULL, NULL, NULL);
     assert_non_null(req);
     tevent_req_set_callback(req, dyndns_test_done, dyndns_test_ctx);
 
@@ -941,7 +947,8 @@ void dyndns_test_timeout(void **state)
 
     req = be_nsupdate_send(tmp_ctx, dyndns_test_ctx->tctx->ev,
                            BE_NSUPDATE_AUTH_GSS_TSIG,
-                           discard_const("test message"), false);
+                           discard_const("test message"), false,
+                           false, NULL, NULL, NULL);
     assert_non_null(req);
     tevent_req_set_callback(req, dyndns_test_done, dyndns_test_ctx);
 
diff --git a/src/tests/cmocka/test_utils.c b/src/tests/cmocka/test_utils.c
index 760e7130723..d07c1b4d5d7 100644
--- a/src/tests/cmocka/test_utils.c
+++ b/src/tests/cmocka/test_utils.c
@@ -2370,6 +2370,63 @@ static void test_sss_filter_sanitize_dn(void **state)
     talloc_free(tmp_ctx);
 }
 
+static void test_sss_parse_uri(void **state)
+{
+    TALLOC_CTX *tmp_ctx;
+    struct sss_parsed_dns_uri *parsed_uri;
+    int ret;
+
+    tmp_ctx = talloc_new(NULL);
+    assert_non_null(tmp_ctx);
+
+    ret = sss_parse_dns_uri(tmp_ctx, "http://host", &parsed_uri);
+    assert_non_null(parsed_uri);
+    assert_int_equal(ret, EOK);
+    assert_string_equal(parsed_uri->scheme, "http");
+    assert_string_equal(parsed_uri->host, "host");
+    assert_string_equal(parsed_uri->address, "host");
+    assert_null(parsed_uri->port);
+    talloc_free(parsed_uri);
+
+    ret = sss_parse_dns_uri(tmp_ctx, "http://10.0.0.1#host", &parsed_uri);
+    assert_int_equal(ret, EOK);
+    assert_non_null(parsed_uri);
+    assert_string_equal(parsed_uri->scheme, "http");
+    assert_string_equal(parsed_uri->host, "host");
+    assert_string_equal(parsed_uri->address, "10.0.0.1");
+    assert_null(parsed_uri->port);
+    talloc_free(parsed_uri);
+
+    ret = sss_parse_dns_uri(tmp_ctx, "  dns+tls://10.0.0.1:853#host", &parsed_uri);
+    assert_int_equal(ret, EOK);
+    assert_non_null(parsed_uri);
+    assert_string_equal(parsed_uri->scheme, "dns+tls");
+    assert_string_equal(parsed_uri->host, "host");
+    assert_string_equal(parsed_uri->address, "10.0.0.1");
+    assert_string_equal(parsed_uri->port, "853");
+    talloc_free(parsed_uri);
+
+    ret = sss_parse_dns_uri(tmp_ctx, "host", &parsed_uri);
+    assert_int_equal(ret, EOK);
+    assert_non_null(parsed_uri);
+    assert_null(parsed_uri->scheme);
+    assert_string_equal(parsed_uri->host, "host");
+    assert_string_equal(parsed_uri->address, "host");
+    assert_null(parsed_uri->port);
+    talloc_free(parsed_uri);
+
+    ret = sss_parse_dns_uri(tmp_ctx, "dns+tls://[cafe::1]:853#host", &parsed_uri);
+    assert_int_equal(ret, EOK);
+    assert_non_null(parsed_uri);
+    assert_string_equal(parsed_uri->scheme, "dns+tls");
+    assert_string_equal(parsed_uri->host, "host");
+    assert_string_equal(parsed_uri->address, "[cafe::1]");
+    assert_string_equal(parsed_uri->port, "853");
+    talloc_free(parsed_uri);
+
+    talloc_free(tmp_ctx);
+}
+
 int main(int argc, const char *argv[])
 {
     poptContext pc;
@@ -2495,6 +2552,9 @@ int main(int argc, const char *argv[])
         cmocka_unit_test_setup_teardown(test_mod_defaults_list,
                                         setup_leak_tests,
                                         teardown_leak_tests),
+        cmocka_unit_test_setup_teardown(test_sss_parse_uri,
+                                        setup_leak_tests,
+                                        teardown_leak_tests),
     };
 
     /* Set debug level to invalid value so we can decide if -d 0 was used. */
diff --git a/src/util/child_common.c b/src/util/child_common.c
index 2633863396c..fb82cce2d0d 100644
--- a/src/util/child_common.c
+++ b/src/util/child_common.c
@@ -22,14 +22,17 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include <stdlib.h>
 #include <sys/types.h>
 #include <fcntl.h>
 #include <signal.h>
+#include <talloc.h>
 #include <tevent.h>
 #include <sys/wait.h>
 #include <errno.h>
 #include <sys/prctl.h>
 
+#include "util/debug.h"
 #include "util/util.h"
 #include "util/find_uid.h"
 #include "db/sysdb.h"
@@ -835,6 +838,30 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
     return ret;
 }
 
+static void log_child_command(TALLOC_CTX *mem_ctx, const char *binary,
+                              char *argv[]) {
+    int n;
+    char *command;
+
+    if(DEBUG_IS_SET(SSSDBG_TRACE_INTERNAL)){
+        command = talloc_strdup(mem_ctx, "");
+        if (command == NULL) {
+            return;
+        }
+        if (argv != NULL) {
+            for (n = 0; argv[n] != NULL; ++n) {
+                command = talloc_asprintf_append(command, " %s", argv[n]);
+                if (command == NULL) {
+                    return;
+                }
+            }
+        }
+        /* child proccess might have no log file open */
+        fprintf(stderr, "exec_child_ex command: [%s] %s\n", binary, command);
+        talloc_free(command);
+    }
+}
+
 void exec_child_ex(TALLOC_CTX *mem_ctx,
                    int *pipefd_to_child, int *pipefd_from_child,
                    const char *binary, const char *logfile,
@@ -882,6 +909,7 @@ void exec_child_ex(TALLOC_CTX *mem_ctx,
         exit(EXIT_FAILURE);
     }
 
+    log_child_command(mem_ctx, binary, argv);
     execv(binary, argv);
     err = errno;
     DEBUG(SSSDBG_OP_FAILURE, "execv failed [%d][%s].\n", err, strerror(err));
diff --git a/src/util/util.c b/src/util/util.c
index 226c746c693..bc34b0ba662 100644
--- a/src/util/util.c
+++ b/src/util/util.c
@@ -1091,3 +1091,83 @@ errno_t sss_getenv(TALLOC_CTX *mem_ctx,
 
     return value != NULL ? EOK : ENOENT;
 }
+
+errno_t sss_parse_dns_uri(TALLOC_CTX *mem_ctx,
+                          const char *uri,
+                          struct sss_parsed_dns_uri **_parsed_uri)
+{
+    char *s, *p;
+    const char *start;
+    struct sss_parsed_dns_uri *parsed_uri;
+    errno_t ret = EOK;
+
+    if (uri == NULL || _parsed_uri == NULL) {
+        return EINVAL;
+    }
+
+    parsed_uri = talloc_zero(mem_ctx, struct sss_parsed_dns_uri);
+    if (parsed_uri == NULL) {
+        ret = ENOMEM;
+        goto fail;
+    }
+
+    start = uri;
+    while(isspace(start[0])) {
+        start++;
+    }
+
+    parsed_uri->data = talloc_strdup(parsed_uri, start);
+    if (parsed_uri->data == NULL) {
+        ret = ENOMEM;
+        goto fail;
+    }
+    s = parsed_uri->data;
+
+    /* scheme */
+    p = strstr(s, "://");
+    if (p != NULL) {
+        parsed_uri->scheme = s;
+        *p = '\000';
+        s = &p[3];
+    }
+
+    /* path part */
+    p = strchr(s, '/');
+    if (p != NULL) {
+        parsed_uri->path = &p[1];
+        *p = '\000';
+    }
+
+    p = strchr(s, '#');
+    if (p != NULL) {
+        parsed_uri->host = &p[1];
+        *p = '\000';
+    }
+
+    if (s[0] == '[') {
+        /* IPv6 address */
+        p = strstr(s, "]:");
+        if (p != NULL) {
+            ++p;
+        }
+    } else {
+        p = strchr(s, ':');
+    }
+    if (p != NULL) {
+        parsed_uri->port = &p[1];
+        *p = '\000';
+    }
+
+    parsed_uri->address = s;
+    if (parsed_uri->host == NULL) {
+        parsed_uri->host = parsed_uri->address;
+    }
+
+    *_parsed_uri = parsed_uri;
+    return EOK;
+
+ fail:
+    talloc_free(parsed_uri);
+    *_parsed_uri = NULL;
+    return ret;
+}
diff --git a/src/util/util.h b/src/util/util.h
index 8674c6c9dbd..3c2b032088e 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -878,4 +878,20 @@ static inline struct timeval sss_tevent_timeval_current_ofs_time_t(time_t secs)
     uint32_t secs32 = (secs > UINT_MAX ? UINT_MAX : secs);
     return tevent_timeval_current_ofs(secs32, 0);
 }
+
+/* parsed uri */
+struct sss_parsed_dns_uri {
+    const char *scheme;
+    const char *address;
+    const char *port;
+    const char *host;
+    const char *path;
+
+    char *data;
+};
+
+errno_t sss_parse_dns_uri(TALLOC_CTX *ctx,
+                          const char *uri,
+                          struct sss_parsed_dns_uri **_parsed_uri);
+
 #endif /* __SSSD_UTIL_H__ */

From 1ef3cf525b5646329cf0b11ec14e20378f55c4c4 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 25 Nov 2024 19:10:09 +0100
Subject: [PATCH 116/129] KRB5: verbosity around ccname handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/krb5/krb5_ccache.c |  4 ++++
 src/providers/krb5/krb5_child.c  | 13 +++++--------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/providers/krb5/krb5_ccache.c b/src/providers/krb5/krb5_ccache.c
index b2e70ce1931..624669fc09d 100644
--- a/src/providers/krb5/krb5_ccache.c
+++ b/src/providers/krb5/krb5_ccache.c
@@ -164,6 +164,9 @@ static errno_t create_ccache_dir(const char *ccdirname, uid_t uid, gid_t gid)
         goto done;
     }
 
+    DEBUG(SSSDBG_TRACE_ALL, "Processing  [%s] for [%"SPRIuid"][%"SPRIgid"]\n",
+          ccdirname, uid, gid);
+
     ret = find_ccdir_parent_data(tmp_ctx, ccdirname, &parent_stat,
                                  &missing_parents);
     if (ret != EOK) {
@@ -228,6 +231,7 @@ errno_t sss_krb5_precreate_ccache(const char *ccname, uid_t uid, gid_t gid)
     } else {
         /* only FILE and DIR types need precreation so far, we ignore any
          * other type */
+        DEBUG(SSSDBG_TRACE_ALL, "No pre-creation needed for [%s]\n", ccname);
         return EOK;
     }
 
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 8918fdff1d4..f2f7ea943c4 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -3168,8 +3168,6 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size,
             kr->old_ccname = talloc_strndup(kr, (char *)(buf + p), len);
             if (kr->old_ccname == NULL) return ENOMEM;
             p += len;
-        } else {
-            DEBUG(SSSDBG_TRACE_INTERNAL, "No old ccache\n");
         }
 
         SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);
@@ -3793,18 +3791,18 @@ static int k5c_check_old_ccache(struct krb5_req *kr)
     if (kr->old_ccname) {
         ret = old_ccache_valid(kr, &kr->old_cc_valid);
         if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, "old_ccache_valid failed.\n");
+            DEBUG(SSSDBG_OP_FAILURE, "old_ccache_valid() failed.\n");
             return ret;
         }
 
         ret = check_if_uid_is_active(kr->uid, &kr->old_cc_active);
         if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, "check_if_uid_is_active failed.\n");
+            DEBUG(SSSDBG_OP_FAILURE, "check_if_uid_is_active() failed.\n");
             return ret;
         }
 
         DEBUG(SSSDBG_TRACE_ALL,
-                "Ccache_file is [%s] and is %s active and TGT is %s valid.\n",
+                "Old ccache is [%s] and is %s active and TGT is %s valid.\n",
                 kr->old_ccname ? kr->old_ccname : "not set",
                 kr->old_cc_active ? "" : "not",
                 kr->old_cc_valid ? "" : "not");
@@ -3831,15 +3829,14 @@ static int k5c_precreate_ccache(struct krb5_req *kr, uint32_t offline)
     if (kr->old_ccname == NULL ||
             (offline && !kr->old_cc_active && !kr->old_cc_valid) ||
             (!offline && !kr->old_cc_active && kr->pd->cmd != SSS_CMD_RENEW)) {
-        DEBUG(SSSDBG_TRACE_ALL, "Recreating ccache\n");
-
+        DEBUG(SSSDBG_TRACE_ALL, "Recreating ccache [%s]\n", kr->ccname);
         ret = sss_krb5_precreate_ccache(kr->ccname, kr->uid, kr->gid);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE, "ccache creation failed.\n");
             return ret;
         }
     } else {
-        /* We can reuse the old ccache */
+        DEBUG(SSSDBG_TRACE_ALL, "Reusing old ccache [%s]\n", kr->old_ccname);
         kr->ccname = kr->old_ccname;
     }
 

From 5e17bc22f6c0ad74ba3ddb198db94acc96cc90a4 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 25 Nov 2024 22:08:15 +0100
Subject: [PATCH 117/129] KRB5: don't pre-create parent dir(s) of wanted
 DIR:/FILE:
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

to match 'kinit' behavior and avoid the need for cap_chown and
cap_dac_override.

:relnote:SSSD doesn't create anymore missing path components of DIR:/FILE:
ccache types while acquiring user's TGT. The parent directory of requested
ccache directory must exist and the user trying to log in must have 'rwx'
access to this directory. This matches behavior of 'kinit'.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                          |   8 +-
 contrib/sssd.spec.in                 |   2 +-
 src/providers/krb5/krb5_ccache.c     | 196 +++++----------------------
 src/providers/krb5/krb5_ccache.h     |   2 +-
 src/providers/krb5/krb5_child.c      |  17 +--
 src/sysv/systemd/sssd-kcm.service.in |   2 +-
 src/tests/krb5_child-test.c          |   7 -
 src/tests/krb5_utils-tests.c         | 125 +----------------
 8 files changed, 44 insertions(+), 315 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index cfc7f69c896..4ecc0a99deb 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -103,10 +103,8 @@ condconfigexists = ConditionPathExists=\|/etc/sssd/sssd.conf\nConditionDirectory
 # Capabilities usage by binaries:
 #   - 'ldap_child': read keytab (dac_read_search)
 #   - 'krb5_child':
-#         - store TGT for a given user (set*id);
-#         - create path components of DIR:/FILE: cache, for example: /run/user/$UID (dac_override, chown)
-#         - read keytab (dac_read_search could be enough but dac_override due to above)
-#     If system doesn't need to support DIR:/FILE: then 'cap_chown' can be stripped and 'cap_dac_override' replaced with 'dac_read_search'
+#         - store TGT for a given user (set*id)
+#         - read keytab (dac_read_search)
 #   - 'selinux_child': currently chown, dac_override, set*id  --  to be narrowed
 #   - 'sssd_pam': read keytab in gss ops (dac_read_search)
 capabilities = CapabilityBoundingSet= CAP_CHOWN CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID CAP_DAC_READ_SEARCH
@@ -5585,7 +5583,7 @@ if SSSD_USER
 	-$(SETCAP) cap_dac_read_search=p $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
-	-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
+	-$(SETCAP) cap_dac_read_search,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/proxy_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/sssd_pam
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 71d3285ffa2..66798a3fa68 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -914,7 +914,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %license COPYING
 %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
 %attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=p) %{_libexecdir}/%{servicename}/ldap_child
-%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
+%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang
 %license COPYING
diff --git a/src/providers/krb5/krb5_ccache.c b/src/providers/krb5/krb5_ccache.c
index 624669fc09d..0a2c4e2c8a3 100644
--- a/src/providers/krb5/krb5_ccache.c
+++ b/src/providers/krb5/krb5_ccache.c
@@ -33,84 +33,6 @@
 #include "util/sss_krb5.h"
 #include "util/util.h"
 
-struct string_list {
-    struct string_list *next;
-    struct string_list *prev;
-    char *s;
-};
-
-static errno_t find_ccdir_parent_data(TALLOC_CTX *mem_ctx,
-                                      const char *ccdirname,
-                                      struct stat *parent_stat,
-                                      struct string_list **missing_parents)
-{
-    int ret = EFAULT;
-    char *parent = NULL;
-    char *end;
-    struct string_list *li;
-
-    ret = stat(ccdirname, parent_stat);
-    if (ret == EOK) {
-        if ( !S_ISDIR(parent_stat->st_mode) ) {
-            DEBUG(SSSDBG_MINOR_FAILURE,
-                  "[%s] is not a directory.\n", ccdirname);
-            return EINVAL;
-        }
-        return EOK;
-    } else {
-        if (errno != ENOENT) {
-            ret = errno;
-            DEBUG(SSSDBG_MINOR_FAILURE,
-                  "stat for [%s] failed: [%d][%s].\n", ccdirname, ret,
-                   strerror(ret));
-            return ret;
-        }
-    }
-
-    li = talloc_zero(mem_ctx, struct string_list);
-    if (li == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "talloc_zero failed.\n");
-        return ENOMEM;
-    }
-
-    li->s = talloc_strdup(li, ccdirname);
-    if (li->s == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "talloc_strdup failed.\n");
-        return ENOMEM;
-    }
-
-    DLIST_ADD(*missing_parents, li);
-
-    parent = talloc_strdup(mem_ctx, ccdirname);
-    if (parent == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "talloc_strdup failed.\n");
-        return ENOMEM;
-    }
-
-    /* We'll remove all trailing slashes from the back so that
-     * we only pass /some/path to find_ccdir_parent_data, not
-     * /some/path */
-    do {
-        end = strrchr(parent, '/');
-        if (end == NULL || end == parent) {
-            DEBUG(SSSDBG_MINOR_FAILURE,
-                  "Cannot find parent directory of [%s], / is not allowed.\n",
-                   ccdirname);
-            ret = EINVAL;
-            goto done;
-        }
-        *end = '\0';
-    } while (*(end+1) == '\0');
-
-    ret = find_ccdir_parent_data(mem_ctx, parent, parent_stat, missing_parents);
-
-done:
-    talloc_free(parent);
-    return ret;
-}
 
 static errno_t check_parent_stat(struct stat *parent_stat, uid_t uid)
 {
@@ -122,17 +44,18 @@ static errno_t check_parent_stat(struct stat *parent_stat, uid_t uid)
     }
 
     if (parent_stat->st_uid == uid) {
-        if (!(parent_stat->st_mode & S_IXUSR)) {
+        if ( (parent_stat->st_mode & (S_IXUSR|S_IRUSR|S_IWUSR)) !=
+            (S_IXUSR|S_IRUSR|S_IWUSR) ) {
             DEBUG(SSSDBG_CRIT_FAILURE,
-                  "Parent directory does not have the search bit set for "
-                   "the owner.\n");
+                  "Parent directory is owned but not accessible by user?!\n");
             return EINVAL;
         }
     } else {
-        if (!(parent_stat->st_mode & S_IXOTH)) {
+        if ( (parent_stat->st_mode & (S_IXOTH|S_IROTH|S_IWOTH)) !=
+            (S_IXOTH|S_IROTH|S_IWOTH) ) {
             DEBUG(SSSDBG_CRIT_FAILURE,
-                  "Parent directory does not have the search bit set for "
-                   "others.\n");
+                  "Parent directory is owned by root and not accessible to "
+                  "user\n");
             return EINVAL;
         }
     }
@@ -140,86 +63,13 @@ static errno_t check_parent_stat(struct stat *parent_stat, uid_t uid)
     return EOK;
 }
 
-static errno_t create_ccache_dir(const char *ccdirname, uid_t uid, gid_t gid)
-{
-    int ret = EFAULT;
-    struct stat parent_stat;
-    struct string_list *missing_parents = NULL;
-    struct string_list *li = NULL;
-    mode_t old_umask;
-    mode_t new_dir_mode;
-    TALLOC_CTX *tmp_ctx = NULL;
-
-    tmp_ctx = talloc_new(NULL);
-    if (tmp_ctx == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "talloc_new failed.\n");
-        return ENOMEM;
-    }
-
-    if (*ccdirname != '/') {
-        DEBUG(SSSDBG_MINOR_FAILURE,
-              "Only absolute paths are allowed, not [%s] .\n", ccdirname);
-        ret = EINVAL;
-        goto done;
-    }
-
-    DEBUG(SSSDBG_TRACE_ALL, "Processing  [%s] for [%"SPRIuid"][%"SPRIgid"]\n",
-          ccdirname, uid, gid);
-
-    ret = find_ccdir_parent_data(tmp_ctx, ccdirname, &parent_stat,
-                                 &missing_parents);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_MINOR_FAILURE,
-              "find_ccdir_parent_data failed.\n");
-        goto done;
-    }
-
-    ret = check_parent_stat(&parent_stat, uid);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_FATAL_FAILURE,
-              "Check the ownership and permissions of krb5_ccachedir: [%s].\n",
-              ccdirname);
-        goto done;
-    }
-
-    DLIST_FOR_EACH(li, missing_parents) {
-        DEBUG(SSSDBG_TRACE_INTERNAL,
-              "Creating directory [%s].\n", li->s);
-        new_dir_mode = 0700;
-
-        old_umask = umask(0000);
-        ret = mkdir(li->s, new_dir_mode);
-        umask(old_umask);
-        if (ret != EOK) {
-            ret = errno;
-            DEBUG(SSSDBG_MINOR_FAILURE,
-                  "mkdir [%s] failed: [%d][%s].\n", li->s, ret,
-                   strerror(ret));
-            goto done;
-        }
-        ret = chown(li->s, uid, gid);
-        if (ret != EOK) {
-            ret = errno;
-            DEBUG(SSSDBG_MINOR_FAILURE,
-                  "chown failed [%d][%s].\n", ret, strerror(ret));
-            goto done;
-        }
-    }
-
-    ret = EOK;
-
-done:
-    talloc_free(tmp_ctx);
-    return ret;
-}
-
-errno_t sss_krb5_precreate_ccache(const char *ccname, uid_t uid, gid_t gid)
+errno_t sss_krb5_precheck_ccache(const char *ccname, uid_t uid, gid_t gid)
 {
     TALLOC_CTX *tmp_ctx = NULL;
     const char *filename;
     char *ccdirname;
     char *end;
+    struct stat parent_stat;
     errno_t ret;
 
     if (ccname[0] == '/') {
@@ -229,9 +79,9 @@ errno_t sss_krb5_precreate_ccache(const char *ccname, uid_t uid, gid_t gid)
     } else if (strncmp(ccname, "DIR:", 4) == 0) {
         filename = ccname + 4;
     } else {
-        /* only FILE and DIR types need precreation so far, we ignore any
+        /* only FILE and DIR types need pre-checks, we ignore any
          * other type */
-        DEBUG(SSSDBG_TRACE_ALL, "No pre-creation needed for [%s]\n", ccname);
+        DEBUG(SSSDBG_TRACE_ALL, "No checks needed for [%s]\n", ccname);
         return EOK;
     }
 
@@ -245,9 +95,9 @@ errno_t sss_krb5_precreate_ccache(const char *ccname, uid_t uid, gid_t gid)
         goto done;
     }
 
-    /* We'll remove all trailing slashes from the back so that
-     * we only pass /some/path to find_ccdir_parent_data, not
-     * /some/path/ */
+    /* Get parent directory of wanted ccache directory/file,
+     * removing trailing slashes from the back
+     */
     do {
         end = strrchr(ccdirname, '/');
         if (end == NULL || end == ccdirname) {
@@ -259,7 +109,23 @@ errno_t sss_krb5_precreate_ccache(const char *ccname, uid_t uid, gid_t gid)
         *end = '\0';
     } while (*(end+1) == '\0');
 
-    ret = create_ccache_dir(ccdirname, uid, gid);
+    ret = stat(ccdirname, &parent_stat);
+    if (ret != 0) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot stat() [%s]\n", ccdirname);
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = check_parent_stat(&parent_stat, uid);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "Check the ownership and permissions of krb5_ccachedir: [%s].\n",
+              ccdirname);
+        goto done;
+    }
+
+    ret = EOK;
+
 done:
     talloc_free(tmp_ctx);
     return ret;
diff --git a/src/providers/krb5/krb5_ccache.h b/src/providers/krb5/krb5_ccache.h
index f3928e644d7..8db2c3538f1 100644
--- a/src/providers/krb5/krb5_ccache.h
+++ b/src/providers/krb5/krb5_ccache.h
@@ -35,7 +35,7 @@ struct tgt_times {
     time_t renew_till;
 };
 
-errno_t sss_krb5_precreate_ccache(const char *ccname, uid_t uid, gid_t gid);
+errno_t sss_krb5_precheck_ccache(const char *ccname, uid_t uid, gid_t gid);
 
 errno_t sss_krb5_cc_destroy(const char *ccname, uid_t uid, gid_t gid);
 
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index f2f7ea943c4..ed39b1b5499 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -3811,11 +3811,11 @@ static int k5c_check_old_ccache(struct krb5_req *kr)
     return EOK;
 }
 
-static int k5c_precreate_ccache(struct krb5_req *kr, uint32_t offline)
+static int k5c_precheck_ccache(struct krb5_req *kr, uint32_t offline)
 {
     errno_t ret;
 
-    /* The ccache file should be (re)created if one of the following conditions
+    /* The ccache path should be checked if one of the following conditions
      * is true:
      * - it doesn't exist (kr->old_ccname == NULL)
      * - the backend is online and the current ccache file is not used, i.e
@@ -3829,8 +3829,8 @@ static int k5c_precreate_ccache(struct krb5_req *kr, uint32_t offline)
     if (kr->old_ccname == NULL ||
             (offline && !kr->old_cc_active && !kr->old_cc_valid) ||
             (!offline && !kr->old_cc_active && kr->pd->cmd != SSS_CMD_RENEW)) {
-        DEBUG(SSSDBG_TRACE_ALL, "Recreating ccache [%s]\n", kr->ccname);
-        ret = sss_krb5_precreate_ccache(kr->ccname, kr->uid, kr->gid);
+        DEBUG(SSSDBG_TRACE_ALL, "Pre-checking ccache [%s]\n", kr->ccname);
+        ret = sss_krb5_precheck_ccache(kr->ccname, kr->uid, kr->gid);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE, "ccache creation failed.\n");
             return ret;
@@ -3859,14 +3859,9 @@ static int k5c_ccache_setup(struct krb5_req *kr, uint32_t offline)
                                    kr->old_ccname, ret, sss_strerror(ret));
     }
 
-    /* Pre-creating the ccache must be done as root, otherwise we can't mkdir
-     * some of the DIR: cache components. One example is /run/user/$UID because
-     * logind doesn't create the directory until the session phase, whereas
-     * we need the directory during the auth phase already
-     */
-    ret = k5c_precreate_ccache(kr, offline);
+    ret = k5c_precheck_ccache(kr, offline);
     if (ret != 0) {
-        DEBUG(SSSDBG_OP_FAILURE, "Cannot precreate ccache\n");
+        DEBUG(SSSDBG_OP_FAILURE, "ccache pre-check failed\n");
         return ret;
     }
 
diff --git a/src/sysv/systemd/sssd-kcm.service.in b/src/sysv/systemd/sssd-kcm.service.in
index ba9e27cd99f..3e48945aaed 100644
--- a/src/sysv/systemd/sssd-kcm.service.in
+++ b/src/sysv/systemd/sssd-kcm.service.in
@@ -14,7 +14,7 @@ ExecStartPre=+-/bin/chmod -f -R g+r @sssdconfdir@
 ExecStartPre=+-/bin/sh -c "/bin/chown -f @SSSD_USER@:@SSSD_USER@ @secdbpath@/*.ldb"
 ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_kcm.log
 ExecStart=@libexecdir@/sssd/sssd_kcm ${DEBUG_LOGGER}
-CapabilityBoundingSet= CAP_DAC_OVERRIDE CAP_CHOWN CAP_SETGID CAP_SETUID
+CapabilityBoundingSet= CAP_DAC_READ_SEARCH CAP_SETGID CAP_SETUID
 SecureBits=noroot noroot-locked
 User=@SSSD_USER@
 Group=@SSSD_USER@
diff --git a/src/tests/krb5_child-test.c b/src/tests/krb5_child-test.c
index ceed041dee2..011a3bb1775 100644
--- a/src/tests/krb5_child-test.c
+++ b/src/tests/krb5_child-test.c
@@ -243,13 +243,6 @@ create_dummy_req(TALLOC_CTX *mem_ctx, const char *user,
     DEBUG(SSSDBG_FUNC_DATA, "ccname [%s] uid [%u] gid [%u]\n",
             kr->ccname, kr->uid, kr->gid);
 
-    ret = sss_krb5_precreate_ccache(kr->ccname,
-                                    kr->uid, kr->gid);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, "create_ccache_dir failed.\n");
-        goto fail;
-    }
-
     return kr;
 
 fail:
diff --git a/src/tests/krb5_utils-tests.c b/src/tests/krb5_utils-tests.c
index 76742922997..04a3733d972 100644
--- a/src/tests/krb5_utils-tests.c
+++ b/src/tests/krb5_utils-tests.c
@@ -74,85 +74,6 @@ void teardown_create_dir(void)
     ck_assert_msg(ret == 0, "Cannot free talloc context.");
 }
 
-static void check_dir(const char *dirname, uid_t uid, gid_t gid, mode_t mode)
-{
-    struct stat stat_buf;
-    int ret;
-
-    ret = stat(dirname, &stat_buf);
-    ck_assert_msg(ret == EOK, "stat failed [%d][%s].", errno, strerror(errno));
-
-    ck_assert_msg(S_ISDIR(stat_buf.st_mode), "[%s] is not a directory.", dirname);
-    ck_assert_msg(stat_buf.st_uid == uid, "uid does not match, "
-                                        "expected [%d], got [%d].",
-                                        uid, stat_buf.st_uid);
-    ck_assert_msg(stat_buf.st_gid == gid, "gid does not match, "
-                                        "expected [%d], got [%d].",
-                                        gid, stat_buf.st_gid);
-    ck_assert_msg((stat_buf.st_mode & ~S_IFMT) == mode,
-                                           "mode of [%s] does not match, "
-                                           "expected [%o], got [%o].", dirname,
-                                            mode, (stat_buf.st_mode & ~S_IFMT));
-}
-
-START_TEST(test_private_ccache_dir_in_user_dir)
-{
-    int ret;
-    char *cwd;
-    char *user_dir;
-    char *dn1;
-    char *dn2;
-    char *dn3;
-    char *filename;
-    uid_t uid = getuid();
-    gid_t gid = getgid();
-
-    if (uid == 0) {
-        uid = 12345;
-        gid = 12345;
-    }
-
-    cwd = getcwd(NULL, 0);
-    ck_assert_msg(cwd != NULL, "getcwd failed.");
-
-    user_dir = talloc_asprintf(tmp_ctx, "%s/%s/user", cwd, TESTS_PATH);
-    free(cwd);
-    ck_assert_msg(user_dir != NULL, "talloc_asprintf failed.");
-    ret = mkdir(user_dir, 0700);
-    ck_assert_msg(ret == EOK, "mkdir failed.");
-    ret = chown(user_dir, uid, gid);
-    ck_assert_msg(ret == EOK, "chown failed.");
-
-    dn1 = talloc_asprintf(tmp_ctx, "%s/a", user_dir);
-    ck_assert_msg(dn1 != NULL, "talloc_asprintf failed.");
-    dn2 = talloc_asprintf(tmp_ctx, "%s/b", dn1);
-    ck_assert_msg(dn2 != NULL, "talloc_asprintf failed.");
-    dn3 = talloc_asprintf(tmp_ctx, "%s/c", dn2);
-    ck_assert_msg(dn3 != NULL, "talloc_asprintf failed.");
-    filename = talloc_asprintf(tmp_ctx, "%s/ccfile", dn3);
-    ck_assert_msg(filename != NULL, "talloc_asprintf failed.");
-
-    ret = chmod(user_dir, 0600);
-    ck_assert_msg(ret == EOK, "chmod failed.");
-    ret = sss_krb5_precreate_ccache(filename, uid, gid);
-    ck_assert_msg(ret == EINVAL, "sss_krb5_precreate_ccache does not return EINVAL "
-                               "while x-bit is missing.");
-
-    ret = chmod(user_dir, 0700);
-    ck_assert_msg(ret == EOK, "chmod failed.");
-    ret = sss_krb5_precreate_ccache(filename, uid, gid);
-    ck_assert_msg(ret == EOK, "sss_krb5_precreate_ccache failed.");
-
-    check_dir(dn3, uid, gid, 0700);
-    RMDIR(dn3);
-    check_dir(dn2, uid, gid, 0700);
-    RMDIR(dn2);
-    check_dir(dn1, uid, gid, 0700);
-    RMDIR(dn1);
-    RMDIR(user_dir);
-}
-END_TEST
-
 START_TEST(test_private_ccache_dir_in_wrong_user_dir)
 {
     int ret;
@@ -178,7 +99,7 @@ START_TEST(test_private_ccache_dir_in_wrong_user_dir)
     filename = talloc_asprintf(tmp_ctx, "%s/ccfile", subdirname);
     ck_assert_msg(filename != NULL, "talloc_asprintf failed.");
 
-    ret = sss_krb5_precreate_ccache(filename, 12345, 12345);
+    ret = sss_krb5_precheck_ccache(filename, 12345, 12345);
     ck_assert_msg(ret == EINVAL, "Creating private ccache dir in wrong user "
                                "dir does not failed with EINVAL.");
 
@@ -235,48 +156,6 @@ START_TEST(test_illegal_patterns)
 }
 END_TEST
 
-START_TEST(test_cc_dir_create)
-{
-    char *residual;
-    char *dirname;
-    char *cwd;
-    uid_t uid = getuid();
-    gid_t gid = getgid();
-    errno_t ret;
-
-    cwd = getcwd(NULL, 0);
-    ck_assert_msg(cwd != NULL, "getcwd failed.");
-
-    dirname = talloc_asprintf(tmp_ctx, "%s/%s/user_dir",
-                              cwd, TESTS_PATH);
-    ck_assert_msg(dirname != NULL, "talloc_asprintf failed.");
-    residual = talloc_asprintf(tmp_ctx, "DIR:%s/%s", dirname, "ccdir");
-    ck_assert_msg(residual != NULL, "talloc_asprintf failed.");
-
-    ret = sss_krb5_precreate_ccache(residual, uid, gid);
-    ck_assert_msg(ret == EOK, "sss_krb5_precreate_ccache failed\n");
-    ret = rmdir(dirname);
-    if (ret < 0) ret = errno;
-    ck_assert_msg(ret == 0, "Cannot remove %s: %s\n", dirname, strerror(ret));
-    talloc_free(residual);
-
-    dirname = talloc_asprintf(tmp_ctx, "%s/%s/user_dir2",
-                              cwd, TESTS_PATH);
-    ck_assert_msg(dirname != NULL, "talloc_asprintf failed.");
-    residual = talloc_asprintf(tmp_ctx, "DIR:%s/%s", dirname, "ccdir/");
-    ck_assert_msg(residual != NULL, "talloc_asprintf failed.");
-
-    ret = sss_krb5_precreate_ccache(residual, uid, gid);
-    ck_assert_msg(ret == EOK, "sss_krb5_precreate_ccache failed\n");
-    ret = rmdir(dirname);
-    if (ret < 0) ret = errno;
-    ck_assert_msg(ret == 0, "Cannot remove %s: %s\n", dirname, strerror(ret));
-    talloc_free(residual);
-    free(cwd);
-}
-END_TEST
-
-
 void setup_talloc_context(void)
 {
     int ret;
@@ -771,9 +650,7 @@ Suite *krb5_utils_suite (void)
     tcase_add_checked_fixture (tc_create_dir, setup_create_dir,
                                teardown_create_dir);
     tcase_add_test (tc_create_dir, test_illegal_patterns);
-    tcase_add_test (tc_create_dir, test_cc_dir_create);
     if (getuid() == 0) {
-        tcase_add_test (tc_create_dir, test_private_ccache_dir_in_user_dir);
         tcase_add_test (tc_create_dir, test_private_ccache_dir_in_wrong_user_dir);
     } else {
         printf("Run as root to enable more tests.\n");

From 541c42ba73b782e696979e90a925a03816c376e8 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 18 Nov 2024 13:08:43 +0100
Subject: [PATCH 118/129] KRB5: skip `switch_creds()` in PKINIT case
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since 'krb5_child' has lost set-id bit and is run under uid/gid of
the backend, it was a no-op.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/krb5/krb5_child.c | 59 +++++++--------------------------
 1 file changed, 12 insertions(+), 47 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index ed39b1b5499..ec019c56a9c 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -2414,10 +2414,6 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
         goto done;
     }
 
-    kerr = restore_creds(kr->pcsc_saved_creds);
-    if (kerr != 0)  {
-        DEBUG(SSSDBG_OP_FAILURE, "restore_creds failed.\n");
-    }
     /* Make sure ccache is created and written as the user */
     if (geteuid() != kr->uid || getegid() != kr->gid) {
         kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
@@ -3295,8 +3291,6 @@ static krb5_error_code get_tgt_times(krb5_context ctx, const char *ccname,
 }
 
 static krb5_error_code get_fast_ccache_with_anonymous_pkinit(krb5_context ctx,
-                                                    uid_t fast_uid,
-                                                    gid_t fast_gid,
                                                     bool posix_domain,
                                                     struct cli_opts *cli_opts,
                                                     krb5_keytab keytab,
@@ -3306,7 +3300,6 @@ static krb5_error_code get_fast_ccache_with_anonymous_pkinit(krb5_context ctx,
 {
     krb5_error_code kerr;
     krb5_get_init_creds_opt *options;
-    struct sss_creds *saved_creds = NULL;
     krb5_preauthtype pkinit = KRB5_PADATA_PK_AS_REQ;
     krb5_creds creds = { 0 };
 
@@ -3341,38 +3334,19 @@ static krb5_error_code get_fast_ccache_with_anonymous_pkinit(krb5_context ctx,
         goto done;
     }
 
-    kerr = switch_creds(NULL, fast_uid, fast_gid, 0, NULL, &saved_creds);
-    if (kerr != 0) {
-        DEBUG(SSSDBG_OP_FAILURE,
-              "Failed to switch credentials to store FAST ccache with "
-              "expected permissions.\n");
-        goto done;
-    }
-
     kerr = create_ccache(ccname, &creds);
     if (kerr != 0) {
         DEBUG(SSSDBG_OP_FAILURE, "Failed to store FAST ccache.\n");
         goto done;
     }
 
-    kerr = restore_creds(saved_creds);
-    if (kerr != 0) {
-        DEBUG(SSSDBG_OP_FAILURE,
-              "Failed to restore credentials, krb5_child might run with wrong "
-              "permissions, aborting.\n");
-        goto done;
-    }
-
 done:
     sss_krb5_get_init_creds_opt_free(ctx, options);
-    talloc_free(saved_creds);
 
     return kerr;
 }
 
 static krb5_error_code get_fast_ccache_with_keytab(krb5_context ctx,
-                                                   uid_t fast_uid,
-                                                   gid_t fast_gid,
                                                    bool posix_domain,
                                                    struct cli_opts *cli_opts,
                                                    krb5_keytab keytab,
@@ -3397,11 +3371,7 @@ static krb5_error_code get_fast_ccache_with_keytab(krb5_context ctx,
                 /* Try to carry on */
             }
 
-            kerr = k5c_become_user(fast_uid, fast_gid, posix_domain);
-            if (kerr != 0) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed: %d\n", kerr);
-                exit(1);
-            }
+            sss_drop_all_caps();
             DEBUG(SSSDBG_TRACE_INTERNAL,
                   "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
 
@@ -3555,8 +3525,7 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
 
     /* Need to recreate the FAST ccache */
     if (cli_opts->fast_use_anonymous_pkinit) {
-        kerr = get_fast_ccache_with_anonymous_pkinit(ctx, fast_uid, fast_gid,
-                                                     posix_domain, cli_opts,
+        kerr = get_fast_ccache_with_anonymous_pkinit(ctx, posix_domain, cli_opts,
                                                      keytab, client_princ,
                                                      ccname, realm);
         if (kerr != 0) {
@@ -3565,8 +3534,8 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
                                         "likely fail!\n");
         }
     } else {
-        kerr = get_fast_ccache_with_keytab(ctx, fast_uid, fast_gid, posix_domain,
-                                           cli_opts, keytab, client_princ, ccname);
+        kerr = get_fast_ccache_with_keytab(ctx, posix_domain, cli_opts,
+                                           keytab, client_princ, ccname);
         if (kerr != 0) {
             DEBUG(SSSDBG_MINOR_FAILURE, "Creating FAST ccache with keytab failed, "
                                         "krb5_child will likely fail!\n");
@@ -4281,24 +4250,20 @@ int main(int argc, const char *argv[])
     /* For PKINIT we might need access to the pcscd socket which by default
      * is only allowed for authenticated users. Since PKINIT is part of
      * the authentication and the user is not authenticated yet, we have
-     * to use different privileges and can only drop it only after the TGT is
-     * received. The fast_uid and fast_gid are the IDs the backend is running
-     * with. This can be either root or the 'sssd' user. Root is allowed by
-     * default and the 'sssd' user is allowed with the help of the
-     * sssd-pcsc.rules policy-kit rule. So those IDs are a suitable choice. We
-     * can only call switch_creds() because after the TGT is returned we have
-     * to switch to the IDs of the user to store the TGT.
+     * to use different privileges and can only drop it after the TGT is
+     * received. IDs the backend (and thus 'krb5_child) is running with are
+     * either root or the 'sssd' user. Root is allowed by default and
+     * the 'sssd' user is allowed with the help of the sssd-pcsc.rules
+     * policy-kit rule. So those IDs are a suitable choice and needs to
+     * be kept until TGT is obtained.
      * If we are offline we have to switch to the user's credentials directly
      * to make sure the empty ccache is created with the expected
      * ownership. */
-    if (IS_SC_AUTHTOK(kr->pd->authtok) && !offline) {
-        kerr = switch_creds(kr, kr->fast_uid, kr->fast_gid, 0, NULL,
-                            &kr->pcsc_saved_creds);
-    } else {
+    if (!IS_SC_AUTHTOK(kr->pd->authtok) || offline) {
         kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
     }
     if (kerr != 0) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "k5c_become_user() failed.\n");
         ret = EFAULT;
         goto done;
     }

From 947f791d8e3e07413b77d1b3782608af1645ca2b Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 18 Nov 2024 16:47:10 +0100
Subject: [PATCH 119/129] KRB5: 'fast-ccache-uid/gid' args aren't used anymore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/krb5/krb5_auth.h          |  2 -
 src/providers/krb5/krb5_child.c         | 15 +----
 src/providers/krb5/krb5_child_handler.c | 22 +-------
 src/tests/cmocka/test_krb5_common.c     | 73 +++++++++----------------
 4 files changed, 29 insertions(+), 83 deletions(-)

diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
index bbdbf61fc8b..02f61f0b3b4 100644
--- a/src/providers/krb5/krb5_auth.h
+++ b/src/providers/krb5/krb5_auth.h
@@ -38,8 +38,6 @@
 
 #define ILLEGAL_PATH_PATTERN "//|/\\./|/\\.\\./"
 
-#define CHILD_OPT_FAST_CCACHE_UID "fast-ccache-uid"
-#define CHILD_OPT_FAST_CCACHE_GID "fast-ccache-gid"
 #define CHILD_OPT_FAST_USE_ANONYMOUS_PKINIT "fast-use-anonymous-pkinit"
 #define CHILD_OPT_REALM "realm"
 #define CHILD_OPT_LIFETIME "lifetime"
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index ec019c56a9c..18512672112 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -115,8 +115,6 @@ struct krb5_req {
     bool old_cc_active;
     enum k5c_fast_opt fast_val;
 
-    uid_t fast_uid;
-    gid_t fast_gid;
     struct sss_creds *pcsc_saved_creds;
 
     struct cli_opts *cli_opts;
@@ -3418,8 +3416,6 @@ static krb5_error_code get_fast_ccache_with_keytab(krb5_context ctx,
 
 static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
                                          krb5_context ctx,
-                                         uid_t fast_uid,
-                                         gid_t fast_gid,
                                          bool posix_domain,
                                          struct cli_opts *cli_opts,
                                          const char *primary,
@@ -3652,8 +3648,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
         fast_principal = NULL;
     }
 
-    kerr = check_fast_ccache(kr, kr->ctx, kr->fast_uid, kr->fast_gid,
-                             kr->posix_domain, kr->cli_opts,
+    kerr = check_fast_ccache(kr, kr->ctx, kr->posix_domain, kr->cli_opts,
                              fast_principal, fast_principal_realm,
                              kr->keytab, &kr->fast_ccname);
     if (kerr != 0) {
@@ -4092,8 +4087,6 @@ int main(int argc, const char *argv[])
     const char *opt_logger = NULL;
     errno_t ret;
     krb5_error_code kerr;
-    uid_t fast_uid = 0;
-    gid_t fast_gid = 0;
     long chain_id = 0;
     struct cli_opts cli_opts = { 0 };
     int sss_creds_password = 0;
@@ -4110,10 +4103,6 @@ int main(int argc, const char *argv[])
         {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
          _("An open file descriptor for the debug logs"), NULL},
         SSSD_LOGGER_OPTS
-        {CHILD_OPT_FAST_CCACHE_UID, 0, POPT_ARG_INT, &fast_uid, 0,
-          _("The user to create FAST ccache as"), NULL},
-        {CHILD_OPT_FAST_CCACHE_GID, 0, POPT_ARG_INT, &fast_gid, 0,
-          _("The group to create FAST ccache as"), NULL},
         {CHILD_OPT_FAST_USE_ANONYMOUS_PKINIT, 0, POPT_ARG_NONE, NULL, 'A',
           _("Use anonymous PKINIT to request FAST armor ticket"), NULL},
         {CHILD_OPT_REALM, 0, POPT_ARG_STRING, &cli_opts.realm, 0,
@@ -4220,8 +4209,6 @@ int main(int argc, const char *argv[])
     }
     talloc_steal(kr, debug_prg_name);
 
-    kr->fast_uid = fast_uid;
-    kr->fast_gid = fast_gid;
     kr->cli_opts = &cli_opts;
     if (sss_creds_password != 0) {
         kr->krb5_get_init_creds_password = sss_krb5_get_init_creds_password;
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index 17befd40c30..1e5327c7f9b 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -328,32 +328,12 @@ errno_t set_extra_args(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
         return EINVAL;
     }
 
-    extra_args = talloc_zero_array(mem_ctx, const char *, 12);
+    extra_args = talloc_zero_array(mem_ctx, const char *, 10);
     if (extra_args == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_array failed.\n");
         return ENOMEM;
     }
 
-    extra_args[c] = talloc_asprintf(extra_args,
-                                    "--"CHILD_OPT_FAST_CCACHE_UID"=%"SPRIuid,
-                                    getuid());
-    if (extra_args[c] == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
-        ret = ENOMEM;
-        goto done;
-    }
-    c++;
-
-    extra_args[c] = talloc_asprintf(extra_args,
-                                    "--"CHILD_OPT_FAST_CCACHE_GID"=%"SPRIgid,
-                                    getgid());
-    if (extra_args[c] == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
-        ret = ENOMEM;
-        goto done;
-    }
-    c++;
-
     krb5_realm = krb5_ctx->realm;
     if (domain != NULL && IS_SUBDOMAIN(domain) && dp_opt_get_bool(krb5_ctx->opts, KRB5_USE_SUBDOMAIN_REALM)) {
         DEBUG(SSSDBG_CONF_SETTINGS, "Use subdomain realm %s.\n", domain->realm);
diff --git a/src/tests/cmocka/test_krb5_common.c b/src/tests/cmocka/test_krb5_common.c
index 4bf3237a73d..33cd4a9dfd8 100644
--- a/src/tests/cmocka/test_krb5_common.c
+++ b/src/tests/cmocka/test_krb5_common.c
@@ -83,8 +83,6 @@ void test_set_extra_args(void **state)
 {
     int ret;
     struct krb5_ctx *krb5_ctx;
-    char *uid_opt;
-    char *gid_opt;
     const char **krb5_child_extra_args;
 
     ret = set_extra_args(NULL, NULL, NULL, NULL);
@@ -92,42 +90,31 @@ void test_set_extra_args(void **state)
 
     krb5_ctx = talloc_zero(global_talloc_context, struct krb5_ctx);
     assert_non_null(krb5_ctx);
-    uid_opt = talloc_asprintf(krb5_ctx, "--fast-ccache-uid=%"SPRIuid, getuid());
-    assert_non_null(uid_opt);
-
-    gid_opt = talloc_asprintf(krb5_ctx, "--fast-ccache-gid=%"SPRIgid, getgid());
-    assert_non_null(gid_opt);
 
     ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
                          &krb5_child_extra_args);
     assert_int_equal(ret, EOK);
-    assert_string_equal(krb5_child_extra_args[0], uid_opt);
-    assert_string_equal(krb5_child_extra_args[1], gid_opt);
-    assert_string_equal(krb5_child_extra_args[2], "--chain-id=0");
-    assert_null(krb5_child_extra_args[3]);
+    assert_string_equal(krb5_child_extra_args[0], "--chain-id=0");
+    assert_null(krb5_child_extra_args[1]);
     talloc_free(krb5_child_extra_args);
 
     krb5_ctx->canonicalize = true;
     ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
                          &krb5_child_extra_args);
     assert_int_equal(ret, EOK);
-    assert_string_equal(krb5_child_extra_args[0], uid_opt);
-    assert_string_equal(krb5_child_extra_args[1], gid_opt);
-    assert_string_equal(krb5_child_extra_args[2], "--canonicalize");
-    assert_string_equal(krb5_child_extra_args[3], "--chain-id=0");
-    assert_null(krb5_child_extra_args[4]);
+    assert_string_equal(krb5_child_extra_args[0], "--canonicalize");
+    assert_string_equal(krb5_child_extra_args[1], "--chain-id=0");
+    assert_null(krb5_child_extra_args[2]);
     talloc_free(krb5_child_extra_args);
 
     krb5_ctx->realm = discard_const(TEST_REALM);
     ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
                          &krb5_child_extra_args);
     assert_int_equal(ret, EOK);
-    assert_string_equal(krb5_child_extra_args[0], uid_opt);
-    assert_string_equal(krb5_child_extra_args[1], gid_opt);
-    assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
-    assert_string_equal(krb5_child_extra_args[3], "--canonicalize");
-    assert_string_equal(krb5_child_extra_args[4], "--chain-id=0");
-    assert_null(krb5_child_extra_args[5]);
+    assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
+    assert_string_equal(krb5_child_extra_args[1], "--canonicalize");
+    assert_string_equal(krb5_child_extra_args[2], "--chain-id=0");
+    assert_null(krb5_child_extra_args[3]);
     talloc_free(krb5_child_extra_args);
 
     /* --fast-principal will be only set if FAST is used */
@@ -135,27 +122,23 @@ void test_set_extra_args(void **state)
     ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
                          &krb5_child_extra_args);
     assert_int_equal(ret, EOK);
-    assert_string_equal(krb5_child_extra_args[0], uid_opt);
-    assert_string_equal(krb5_child_extra_args[1], gid_opt);
-    assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
-    assert_string_equal(krb5_child_extra_args[3], "--canonicalize");
-    assert_string_equal(krb5_child_extra_args[4], "--chain-id=0");
-    assert_null(krb5_child_extra_args[5]);
+    assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
+    assert_string_equal(krb5_child_extra_args[1], "--canonicalize");
+    assert_string_equal(krb5_child_extra_args[2], "--chain-id=0");
+    assert_null(krb5_child_extra_args[3]);
     talloc_free(krb5_child_extra_args);
 
     krb5_ctx->use_fast_str = discard_const(TEST_FAST_STR);
     ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
                          &krb5_child_extra_args);
     assert_int_equal(ret, EOK);
-    assert_string_equal(krb5_child_extra_args[0], uid_opt);
-    assert_string_equal(krb5_child_extra_args[1], gid_opt);
-    assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
-    assert_string_equal(krb5_child_extra_args[3], "--use-fast=" TEST_FAST_STR);
-    assert_string_equal(krb5_child_extra_args[4],
+    assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
+    assert_string_equal(krb5_child_extra_args[1], "--use-fast=" TEST_FAST_STR);
+    assert_string_equal(krb5_child_extra_args[2],
                         "--fast-principal=" TEST_FAST_PRINC);
-    assert_string_equal(krb5_child_extra_args[5], "--canonicalize");
-    assert_string_equal(krb5_child_extra_args[6], "--chain-id=0");
-    assert_null(krb5_child_extra_args[7]);
+    assert_string_equal(krb5_child_extra_args[3], "--canonicalize");
+    assert_string_equal(krb5_child_extra_args[4], "--chain-id=0");
+    assert_null(krb5_child_extra_args[5]);
     talloc_free(krb5_child_extra_args);
 
     krb5_ctx->lifetime_str = discard_const(TEST_LIFE_STR);
@@ -163,18 +146,16 @@ void test_set_extra_args(void **state)
     ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
                          &krb5_child_extra_args);
     assert_int_equal(ret, EOK);
-    assert_string_equal(krb5_child_extra_args[0], uid_opt);
-    assert_string_equal(krb5_child_extra_args[1], gid_opt);
-    assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
-    assert_string_equal(krb5_child_extra_args[3], "--lifetime=" TEST_LIFE_STR);
-    assert_string_equal(krb5_child_extra_args[4],
+    assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
+    assert_string_equal(krb5_child_extra_args[1], "--lifetime=" TEST_LIFE_STR);
+    assert_string_equal(krb5_child_extra_args[2],
                         "--renewable-lifetime=" TEST_RLIFE_STR);
-    assert_string_equal(krb5_child_extra_args[5], "--use-fast=" TEST_FAST_STR);
-    assert_string_equal(krb5_child_extra_args[6],
+    assert_string_equal(krb5_child_extra_args[3], "--use-fast=" TEST_FAST_STR);
+    assert_string_equal(krb5_child_extra_args[4],
                         "--fast-principal=" TEST_FAST_PRINC);
-    assert_string_equal(krb5_child_extra_args[7], "--canonicalize");
-    assert_string_equal(krb5_child_extra_args[8], "--chain-id=0");
-    assert_null(krb5_child_extra_args[9]);
+    assert_string_equal(krb5_child_extra_args[5], "--canonicalize");
+    assert_string_equal(krb5_child_extra_args[6], "--chain-id=0");
+    assert_null(krb5_child_extra_args[7]);
     talloc_free(krb5_child_extra_args);
 
     talloc_free(krb5_ctx);

From 19dd64322857fba3eea2dd3855a79ba4f663d849 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 26 Nov 2024 21:27:08 +0100
Subject: [PATCH 120/129] KRB5: don't require effective CAP_DAC_READ_SEARCH
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                      |  3 ++-
 src/providers/krb5/krb5_ccache.c | 10 ++++++++--
 src/providers/krb5/krb5_child.c  |  2 ++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 4ecc0a99deb..57eb0e25c8d 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -103,8 +103,9 @@ condconfigexists = ConditionPathExists=\|/etc/sssd/sssd.conf\nConditionDirectory
 # Capabilities usage by binaries:
 #   - 'ldap_child': read keytab (dac_read_search)
 #   - 'krb5_child':
-#         - store TGT for a given user (set*id)
+#         - check old ccache / pre-check ccache path (dac_read_search, set*id)
 #         - read keytab (dac_read_search)
+#         - store TGT for a given user (set*id)
 #   - 'selinux_child': currently chown, dac_override, set*id  --  to be narrowed
 #   - 'sssd_pam': read keytab in gss ops (dac_read_search)
 capabilities = CapabilityBoundingSet= CAP_CHOWN CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID CAP_DAC_READ_SEARCH
diff --git a/src/providers/krb5/krb5_ccache.c b/src/providers/krb5/krb5_ccache.c
index 0a2c4e2c8a3..5497b358893 100644
--- a/src/providers/krb5/krb5_ccache.c
+++ b/src/providers/krb5/krb5_ccache.c
@@ -109,7 +109,9 @@ errno_t sss_krb5_precheck_ccache(const char *ccname, uid_t uid, gid_t gid)
         *end = '\0';
     } while (*(end+1) == '\0');
 
+    sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
     ret = stat(ccdirname, &parent_stat);
+    sss_set_cap_effective(CAP_DAC_READ_SEARCH, false);
     if (ret != 0) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Cannot stat() [%s]\n", ccdirname);
         ret = EINVAL;
@@ -335,7 +337,9 @@ static errno_t sss_low_level_path_check(const char *ccname)
         return EOK;
     }
 
+    sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
     ret = stat(filename, &buf);
+    sss_set_cap_effective(CAP_DAC_READ_SEARCH, false);
     if (ret == -1) return errno;
     return EOK;
 }
@@ -353,11 +357,13 @@ errno_t sss_krb5_cc_verify_ccache(const char *ccname, uid_t uid, gid_t gid,
     krb5_error_code kerr;
     errno_t ret;
 
-    /* first of all verify if the old ccache file/dir exists as we may be
+    /* First of all verify if the old ccache file/dir exists as we may be
      * trying to verify if an old ccache exists at all. If no file/dir
      * exists bail out immediately otherwise a following krb5_cc_resolve()
      * call may actually create paths and files we do not want to have
-     * around */
+     * around.
+     * This relies on CAP_DAC_READ_SEARCH.
+     */
     ret = sss_low_level_path_check(ccname);
     if (ret) {
         return ret;
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 18512672112..77562572378 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -4018,8 +4018,10 @@ static krb5_error_code privileged_krb5_setup(struct krb5_req *kr,
             (kr->fast_val == K5C_FAST_NEVER && kr->validate == false))) {
         /* A Keytab is not used if fast with anonymous pkinit is used (and validate is false)*/
         if (!(kr->cli_opts->fast_use_anonymous_pkinit == true && kr->validate == false)) {
+            sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
             kerr = copy_keytab_into_memory(kr, kr->ctx, kr->keytab, &mem_keytab,
                                            NULL);
+            sss_set_cap_effective(CAP_DAC_READ_SEARCH, false);
             if (kerr != 0) {
                 DEBUG(SSSDBG_OP_FAILURE, "copy_keytab_into_memory failed.\n");
                 return kerr;

From 89d61e66b8753935ca9b2b017575e93055350d5e Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 27 Nov 2024 14:27:07 +0100
Subject: [PATCH 121/129] KRB5: verbosity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/krb5/krb5_child.c | 50 ++++++++++++++++++++++-----------
 1 file changed, 34 insertions(+), 16 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 77562572378..ae3d8bda203 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -22,6 +22,8 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include "config.h"
+
 #include <sys/types.h>
 #include <unistd.h>
 #include <sys/stat.h>
@@ -158,6 +160,31 @@ static errno_t k5c_become_user(uid_t uid, gid_t gid, bool is_posix)
     return become_user(uid, gid, true);
 }
 
+void log_process_caps(const char *stage)
+{
+    errno_t ret;
+    uid_t ruid, euid, suid;
+    gid_t rgid, egid, sgid;
+    char *caps = NULL;
+
+    getresuid(&ruid, &euid, &suid);
+    getresgid(&rgid, &egid, &sgid);
+
+    DEBUG(SSSDBG_CONF_SETTINGS,
+         "%s under ruid=%"SPRIuid", euid=%"SPRIuid", suid=%"SPRIuid" : "
+                  "rgid=%"SPRIgid", egid=%"SPRIgid", sgid=%"SPRIgid"\n",
+         stage, ruid, euid, suid, rgid, egid, sgid);
+
+    ret = sss_log_caps_to_str(true, &caps);
+    if (ret == 0) {
+        DEBUG(SSSDBG_CONF_SETTINGS, "With following capabilities:\n%s",
+              caps ? caps : "   (nothing)\n");
+        talloc_free(caps);
+    } else {
+        DEBUG(SSSDBG_MINOR_FAILURE, "Failed to get current capabilities\n");
+    }
+}
+
 static krb5_error_code set_lifetime_options(struct cli_opts *cli_opts,
                                             krb5_get_init_creds_opt *options)
 {
@@ -4093,7 +4120,7 @@ int main(int argc, const char *argv[])
     struct cli_opts cli_opts = { 0 };
     int sss_creds_password = 0;
     long dummy_long = 0;
-    char *caps = NULL;
+
 
     struct poptOption long_options[] = {
         POPT_AUTOHELP
@@ -4164,6 +4191,10 @@ int main(int argc, const char *argv[])
 
     poptFreeContext(pc);
 
+    /* This call is more for the sake of consistency than
+     * anything else. Any change of euid will reset DUMPABLE
+     * to the value of '/proc/sys/fs/suid_dumpable'
+     */
     prctl(PR_SET_DUMPABLE, (dumpable == 0) ? 0 : 1);
 
     debug_prg_name = talloc_asprintf(NULL, "krb5_child[%d]", getpid());
@@ -4189,19 +4220,7 @@ int main(int argc, const char *argv[])
     DEBUG_INIT(debug_level, opt_logger);
     sss_set_debug_backtrace_enable((backtrace == 0) ? false : true);
 
-    DEBUG(SSSDBG_CONF_SETTINGS,
-         "Starting under uid=%"SPRIuid" (euid=%"SPRIuid") : "
-         "gid=%"SPRIgid" (egid=%"SPRIgid")\n",
-         getuid(), geteuid(), getgid(), getegid());
-
-    ret = sss_log_caps_to_str(true, &caps);
-    if (ret == 0) {
-        DEBUG(SSSDBG_CONF_SETTINGS, "With following capabilities:\n%s",
-              caps ? caps : "   (nothing)\n");
-        talloc_free(caps);
-    } else {
-        DEBUG(SSSDBG_MINOR_FAILURE, "Failed to get current capabilities\n");
-    }
+    log_process_caps("Starting");
 
     kr = talloc_zero(NULL, struct krb5_req);
     if (kr == NULL) {
@@ -4257,8 +4276,7 @@ int main(int argc, const char *argv[])
         goto done;
     }
 
-    DEBUG(SSSDBG_TRACE_INTERNAL,
-          "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
+    log_process_caps("Running");
 
     try_open_krb5_conf();
 

From 65538771154c49fd2541f3d17dbccf85f986e4e8 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 27 Nov 2024 13:12:48 +0100
Subject: [PATCH 122/129] KRB5: drop cap_set*id as soon as possible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set user uid/gid as real IDs as a first step in `privileged_krb5_setup()`
and drop cap_set*id afterwards.

Having real_ids == user_ids and set_ids == service_ids should be
enough to switch thru and back.

:relnote:`krb5-child-test` was removed. Corresponding tests under
'src/tests/system/' are aimed to provide a comprehensive test coverage
of 'krb5_child' functionality.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                        |  30 --
 src/providers/krb5/krb5_ccache.c   | 119 +++++--
 src/providers/krb5/krb5_ccache.h   |  11 +-
 src/providers/krb5/krb5_child.c    |  73 ++--
 src/tests/cwrap/test_become_user.c |  56 ----
 src/tests/krb5_child-test.c        | 518 -----------------------------
 src/util/become_user.c             | 140 --------
 src/util/util.h                    |   8 +-
 8 files changed, 142 insertions(+), 813 deletions(-)
 delete mode 100644 src/tests/krb5_child-test.c

diff --git a/Makefile.am b/Makefile.am
index 57eb0e25c8d..7d1ea270471 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -369,7 +369,6 @@ endif   # HAVE_CMOCKA
 
 check_PROGRAMS = \
     stress-tests \
-    krb5-child-test \
     test_ssh_client \
     $(non_interactive_cmocka_based_tests) \
     $(non_interactive_check_based_tests)
@@ -2499,35 +2498,6 @@ stress_tests_LDADD = \
     $(SSSD_LIBS) \
     libsss_test_common.la
 
-krb5_child_test_SOURCES = \
-    src/tests/krb5_child-test.c \
-    src/providers/krb5/krb5_utils.c \
-    src/providers/krb5/krb5_ccache.c \
-    src/providers/krb5/krb5_child_handler.c \
-    src/providers/krb5/krb5_common.c \
-    src/providers/krb5/krb5_opts.c \
-    src/util/sss_krb5.c \
-    src/util/sss_iobuf.c \
-    src/providers/data_provider_fo.c \
-    src/providers/data_provider_opts.c \
-    src/providers/data_provider_callbacks.c \
-    src/util/become_user.c \
-    $(SSSD_FAILOVER_OBJ) \
-    $(NULL)
-krb5_child_test_CFLAGS = \
-    $(AM_CFLAGS) \
-    -DKRB5_CHILD_DIR=\"$(builddir)\" \
-    $(KRB5_CFLAGS) \
-    $(CHECK_CFLAGS)
-krb5_child_test_LDADD = \
-    $(SSSD_LIBS) \
-    $(CARES_LIBS) \
-    $(KRB5_LIBS) \
-    $(CHECK_LIBS) \
-    $(PCRE_LIBS) \
-    $(SSSD_INTERNAL_LTLIBS) \
-    libsss_test_common.la
-
 test_ssh_client_SOURCES = \
     src/tests/test_ssh_client.c \
     $(NULL)
diff --git a/src/providers/krb5/krb5_ccache.c b/src/providers/krb5/krb5_ccache.c
index 5497b358893..e86e7a90227 100644
--- a/src/providers/krb5/krb5_ccache.c
+++ b/src/providers/krb5/krb5_ccache.c
@@ -23,6 +23,9 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include "config.h"
+#include <unistd.h>
+
 #ifdef HAVE_KRB5_KRB5_H
 #include <krb5/krb5.h>
 #else
@@ -34,6 +37,67 @@
 #include "util/util.h"
 
 
+/* real id == user id; set id == service id */
+errno_t switch_to_user(void)
+{
+    int ret;
+    uid_t ruid, euid, suid;
+    gid_t rgid, egid, sgid;
+
+    ret = getresuid(&ruid, &euid, &suid);
+    if (ret != 0) {
+        return errno;
+    }
+
+    ret = getresgid(&rgid, &egid, &sgid);
+    if (ret != 0) {
+        return errno;
+    }
+
+    ret = setresuid(-1, ruid, -1);
+    if (ret != 0) {
+        return errno;
+    }
+
+    ret = setresgid(-1, rgid, -1);
+    if (ret != 0) {
+        setresuid(-1, suid, -1);
+        return errno;
+    }
+
+    return EOK;
+}
+
+static errno_t switch_to_service(void)
+{
+    int ret;
+    uid_t ruid, euid, suid;
+    gid_t rgid, egid, sgid;
+
+    ret = getresuid(&ruid, &euid, &suid);
+    if (ret != 0) {
+        return errno;
+    }
+
+    ret = getresgid(&rgid, &egid, &sgid);
+    if (ret != 0) {
+        return errno;
+    }
+
+    ret = setresuid(-1, suid, -1);
+    if (ret != 0) {
+        return errno;
+    }
+
+    ret = setresgid(-1, sgid, -1);
+    if (ret != 0) {
+        setresuid(-1, ruid, -1);
+        return errno;
+    }
+
+    return EOK;
+}
+
 static errno_t check_parent_stat(struct stat *parent_stat, uid_t uid)
 {
     if (parent_stat->st_uid != 0 && parent_stat->st_uid != uid) {
@@ -134,7 +198,6 @@ errno_t sss_krb5_precheck_ccache(const char *ccname, uid_t uid, gid_t gid)
 }
 
 struct sss_krb5_ccache {
-    struct sss_creds *creds;
     krb5_context context;
     krb5_ccache ccache;
 };
@@ -147,14 +210,12 @@ static int sss_free_krb5_ccache(void *mem)
         krb5_cc_close(cc->context, cc->ccache);
     }
     krb5_free_context(cc->context);
-    restore_creds(cc->creds);
     return 0;
 }
 
-static errno_t sss_open_ccache_as_user(TALLOC_CTX *mem_ctx,
-                                       const char *ccname,
-                                       uid_t uid, gid_t gid,
-                                       struct sss_krb5_ccache **ccache)
+static errno_t sss_open_ccache(TALLOC_CTX *mem_ctx,
+                               const char *ccname,
+                               struct sss_krb5_ccache **ccache)
 {
     struct sss_krb5_ccache *cc;
     krb5_error_code kerr;
@@ -166,11 +227,6 @@ static errno_t sss_open_ccache_as_user(TALLOC_CTX *mem_ctx,
     }
     talloc_set_destructor((TALLOC_CTX *)cc, sss_free_krb5_ccache);
 
-    ret = switch_creds(cc, uid, gid, 0, NULL, &cc->creds);
-    if (ret) {
-        goto done;
-    }
-
     kerr = sss_krb5_init_context(&cc->context);
     if (kerr) {
         ret = EIO;
@@ -220,7 +276,7 @@ static errno_t sss_destroy_ccache(struct sss_krb5_ccache *cc)
     return ret;
 }
 
-errno_t sss_krb5_cc_destroy(const char *ccname, uid_t uid, gid_t gid)
+errno_t sss_krb5_cc_destroy(const char *ccname)
 {
     struct sss_krb5_ccache *cc = NULL;
     TALLOC_CTX *tmp_ctx;
@@ -237,7 +293,7 @@ errno_t sss_krb5_cc_destroy(const char *ccname, uid_t uid, gid_t gid)
         return ENOMEM;
     }
 
-    ret = sss_open_ccache_as_user(tmp_ctx, ccname, uid, gid, &cc);
+    ret = sss_open_ccache(tmp_ctx, ccname, &cc);
     if (ret) {
         goto done;
     }
@@ -337,15 +393,13 @@ static errno_t sss_low_level_path_check(const char *ccname)
         return EOK;
     }
 
-    sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
     ret = stat(filename, &buf);
-    sss_set_cap_effective(CAP_DAC_READ_SEARCH, false);
     if (ret == -1) return errno;
     return EOK;
 }
 
-errno_t sss_krb5_cc_verify_ccache(const char *ccname, uid_t uid, gid_t gid,
-                                  const char *realm, const char *principal)
+errno_t sss_krb5_cc_verify_ccache(const char *ccname, const char *realm,
+                                  const char *principal)
 {
     struct sss_krb5_ccache *cc = NULL;
     TALLOC_CTX *tmp_ctx = NULL;
@@ -355,34 +409,40 @@ errno_t sss_krb5_cc_verify_ccache(const char *ccname, uid_t uid, gid_t gid,
     krb5_creds mcred = { 0 };
     krb5_creds cred = { 0 };
     krb5_error_code kerr;
-    errno_t ret;
+    errno_t ret, switch_ret;
+
+    ret = switch_to_user();
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to user IDs: %d\n", ret);
+        return ret;
+    }
 
     /* First of all verify if the old ccache file/dir exists as we may be
      * trying to verify if an old ccache exists at all. If no file/dir
      * exists bail out immediately otherwise a following krb5_cc_resolve()
      * call may actually create paths and files we do not want to have
      * around.
-     * This relies on CAP_DAC_READ_SEARCH.
      */
     ret = sss_low_level_path_check(ccname);
     if (ret) {
-        return ret;
+        goto done;
     }
 
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new failed.\n");
-        return ENOMEM;
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed.\n");
+        ret = ENOMEM;
+        goto done;
     }
 
-    ret = sss_open_ccache_as_user(tmp_ctx, ccname, uid, gid, &cc);
+    ret = sss_open_ccache(tmp_ctx, ccname, &cc);
     if (ret) {
         goto done;
     }
 
     tgt_name = talloc_asprintf(tmp_ctx, "krbtgt/%s@%s", realm, realm);
     if (!tgt_name) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf() failed.\n");
         ret = ENOMEM;
         goto done;
     }
@@ -428,6 +488,11 @@ errno_t sss_krb5_cc_verify_ccache(const char *ccname, uid_t uid, gid_t gid,
     krb5_free_cred_contents(cc->context, &cred);
 
 done:
+    switch_ret = switch_to_service();
+    if (switch_ret != EOK) {
+        if (ret == EOK) ret = switch_ret;
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to service IDs: %d\n", ret);
+    }
     if (tgt_princ) krb5_free_principal(cc->context, tgt_princ);
     if (princ) krb5_free_principal(cc->context, princ);
     talloc_free(tmp_ctx);
@@ -435,8 +500,7 @@ errno_t sss_krb5_cc_verify_ccache(const char *ccname, uid_t uid, gid_t gid,
 }
 
 errno_t safe_remove_old_ccache_file(const char *old_ccache,
-                                    const char *new_ccache,
-                                    uid_t uid, gid_t gid)
+                                    const char *new_ccache)
 {
     if ((old_ccache == new_ccache)
         || (old_ccache && new_ccache
@@ -446,7 +510,8 @@ errno_t safe_remove_old_ccache_file(const char *old_ccache,
         return EOK;
     }
 
-    return sss_krb5_cc_destroy(old_ccache, uid, gid);
+    /* safe_remove_old_ccache_file() is always run with user effective IDs */
+    return sss_krb5_cc_destroy(old_ccache);
 }
 
 krb5_error_code copy_ccache_into_memory(TALLOC_CTX *mem_ctx, krb5_context kctx,
diff --git a/src/providers/krb5/krb5_ccache.h b/src/providers/krb5/krb5_ccache.h
index 8db2c3538f1..c5aa56c72c1 100644
--- a/src/providers/krb5/krb5_ccache.h
+++ b/src/providers/krb5/krb5_ccache.h
@@ -37,21 +37,22 @@ struct tgt_times {
 
 errno_t sss_krb5_precheck_ccache(const char *ccname, uid_t uid, gid_t gid);
 
-errno_t sss_krb5_cc_destroy(const char *ccname, uid_t uid, gid_t gid);
+errno_t sss_krb5_cc_destroy(const char *ccname);
 
 errno_t sss_krb5_check_ccache_princ(krb5_context kctx,
                                     const char *ccname,
                                     krb5_principal user_princ);
 
-errno_t sss_krb5_cc_verify_ccache(const char *ccname, uid_t uid, gid_t gid,
-                                  const char *realm, const char *principal);
+errno_t sss_krb5_cc_verify_ccache(const char *ccname, const char *realm,
+                                  const char *principal);
 
 errno_t get_ccache_file_data(const char *ccache_file, const char *client_name,
                              struct tgt_times *tgtt);
 
 errno_t safe_remove_old_ccache_file(const char *old_ccache,
-                                    const char *new_ccache,
-                                    uid_t uid, gid_t gid);
+                                    const char *new_ccache);
+
+errno_t switch_to_user(void);
 
 /**
  * @brief Copy given ccache into a MEMORY ccache
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index ae3d8bda203..7c91d62715e 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -150,16 +150,6 @@ static errno_t k5c_attach_keep_alive_msg(struct krb5_req *kr);
 static errno_t k5c_recv_data(struct krb5_req *kr, int fd, uint32_t *offline);
 static errno_t k5c_send_data(struct krb5_req *kr, int fd, errno_t error);
 
-static errno_t k5c_become_user(uid_t uid, gid_t gid, bool is_posix)
-{
-    if (is_posix == false) {
-        DEBUG(SSSDBG_TRACE_FUNC,
-              "Will not drop privileges for a non-POSIX user\n");
-        return EOK;
-    }
-    return become_user(uid, gid, true);
-}
-
 void log_process_caps(const char *stage)
 {
     errno_t ret;
@@ -2440,16 +2430,13 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
     }
 
     /* Make sure ccache is created and written as the user */
-    if (geteuid() != kr->uid || getegid() != kr->gid) {
-        kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
-        if (kerr != 0) {
-            DEBUG(SSSDBG_CRIT_FAILURE, "become_user failed.\n");
-            goto done;
-        }
+    kerr = switch_to_user();
+    if (kerr != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to user IDs: %d\n", ret);
+        goto done;
     }
 
-    DEBUG(SSSDBG_TRACE_INTERNAL,
-          "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
+    log_process_caps("Saving ccache");
 
     /* If kr->ccname is cache collection (DIR:/...), we want to work
      * directly with file ccache (DIR::/...), but cache collection
@@ -2478,8 +2465,7 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
         goto done;
     }
 
-    kerr = safe_remove_old_ccache_file(kr->old_ccname, kr->ccname,
-                                       kr->uid, kr->gid);
+    kerr = safe_remove_old_ccache_file(kr->old_ccname, kr->ccname);
     if (kerr != EOK) {
         DEBUG(SSSDBG_MINOR_FAILURE,
               "Failed to remove old ccache file [%s], "
@@ -2881,8 +2867,7 @@ static errno_t tgt_req_child(struct krb5_req *kr)
          * to create a new random ccache if sshd with privilege separation is
          * used. */
         if (kr->old_cc_active == false && kr->old_ccname) {
-            ret = safe_remove_old_ccache_file(kr->old_ccname, NULL,
-                    kr->uid, kr->gid);
+            ret = safe_remove_old_ccache_file(kr->old_ccname, NULL);
             if (ret != EOK) {
                 DEBUG(SSSDBG_CRIT_FAILURE,
                         "Failed to remove old ccache file [%s], "
@@ -3751,7 +3736,6 @@ static errno_t old_ccache_valid(struct krb5_req *kr, bool *_valid)
     valid = false;
 
     ret = sss_krb5_cc_verify_ccache(kr->old_ccname,
-                                    kr->uid, kr->gid,
                                     kr->realm, kr->upn);
     switch (ret) {
         case ERR_NOT_FOUND:
@@ -4002,6 +3986,32 @@ static krb5_error_code privileged_krb5_setup(struct krb5_req *kr,
     int ret;
     char *mem_keytab;
 
+    /* Make use of cap_set*id first to bootstap process */
+    sss_set_cap_effective(CAP_SETGID, true);
+    if (geteuid() != 0) {
+        ret = setgroups(0, NULL);
+        if (ret != 0) {
+            ret = errno;
+            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to drop supplementary groups: %d\n", ret);
+            return ret;
+        }
+    } /* Otherwise keep supplementary groups to have access to DB_PATH to store FAST ccache */
+    ret = setresgid(kr->gid, -1, -1);
+    if (ret != 0) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to set real GID: %d\n", ret);
+        return ret;
+    }
+    sss_set_cap_effective(CAP_SETUID, true);
+    ret = setresuid(kr->uid, -1, -1);
+    if (ret != 0) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to set real UID: %d\n", ret);
+        return ret;
+    }
+    sss_drop_cap(CAP_SETUID);
+    sss_drop_cap(CAP_SETGID);
+
     kr->realm = kr->cli_opts->realm;
     if (kr->realm == NULL) {
         DEBUG(SSSDBG_MINOR_FAILURE, "Realm not available.\n");
@@ -4069,7 +4079,7 @@ static krb5_error_code privileged_krb5_setup(struct krb5_req *kr,
 
     if (kr->send_pac) {
         /* This is to establish connection with 'sssd_pac' while process
-         * still runs under privileged user.
+         * still runs under service user.
          */
         ret = sss_pac_check_and_open();
         if (ret != EOK) {
@@ -4255,6 +4265,8 @@ int main(int argc, const char *argv[])
         goto done;
     }
 
+    sss_drop_all_caps();
+
     /* For PKINIT we might need access to the pcscd socket which by default
      * is only allowed for authenticated users. Since PKINIT is part of
      * the authentication and the user is not authenticated yet, we have
@@ -4268,12 +4280,12 @@ int main(int argc, const char *argv[])
      * to make sure the empty ccache is created with the expected
      * ownership. */
     if (!IS_SC_AUTHTOK(kr->pd->authtok) || offline) {
-        kerr = k5c_become_user(kr->uid, kr->gid, kr->posix_domain);
-    }
-    if (kerr != 0) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "k5c_become_user() failed.\n");
-        ret = EFAULT;
-        goto done;
+        ret = switch_to_user();
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to user IDs: %d\n", ret);
+            ret = EFAULT;
+            goto done;
+        }
     }
 
     log_process_caps("Running");
@@ -4292,7 +4304,6 @@ int main(int argc, const char *argv[])
     case SSS_PAM_AUTHENTICATE:
         /* If we are offline, we need to create an empty ccache file */
         if (offline) {
-            DEBUG(SSSDBG_TRACE_FUNC, "Will perform offline auth\n");
             ret = create_empty_ccache(kr);
         } else {
             DEBUG(SSSDBG_TRACE_FUNC, "Will perform online auth\n");
diff --git a/src/tests/cwrap/test_become_user.c b/src/tests/cwrap/test_become_user.c
index 1ffc95917af..1df6e3c06f8 100644
--- a/src/tests/cwrap/test_become_user.c
+++ b/src/tests/cwrap/test_become_user.c
@@ -70,61 +70,6 @@ void test_become_user(void **state)
     assert_int_equal(WEXITSTATUS(status), 0);
 }
 
-void test_switch_user(void **state)
-{
-    errno_t ret;
-    struct passwd *sssd;
-    TALLOC_CTX *tmp_ctx;
-    struct sss_creds *saved_creds;
-    struct sss_creds *saved_creds2 = NULL;
-
-    assert_true(leak_check_setup());
-
-    tmp_ctx = talloc_new(global_talloc_context);
-    assert_non_null(tmp_ctx);
-
-    /* Must root as root, real or fake */
-    assert_int_equal(geteuid(), 0);
-
-    sssd = getpwnam("sssd");
-    assert_non_null(sssd);
-
-    check_leaks_push(tmp_ctx);
-
-    ret = switch_creds(tmp_ctx, sssd->pw_uid, sssd->pw_gid,
-                       0, NULL, &saved_creds);
-    assert_int_equal(ret, EOK);
-    assert_int_equal(geteuid(), sssd->pw_uid);
-    assert_int_equal(getegid(), sssd->pw_gid);
-    /* Only effective UID is changed.. */
-    assert_int_equal(getuid(), 0);
-    assert_int_equal(getgid(), 0);
-
-    assert_non_null(saved_creds);
-    assert_int_equal(saved_creds->uid, 0);
-    assert_int_equal(saved_creds->gid, 0);
-
-    /* Attempt to restore creds again */
-    ret = switch_creds(tmp_ctx, sssd->pw_uid, sssd->pw_gid,
-                       0, NULL, &saved_creds2);
-    assert_int_equal(ret, EOK);
-    assert_null(saved_creds2);
-
-    /* restore root */
-    ret = restore_creds(saved_creds);
-    assert_int_equal(ret, EOK);
-    assert_int_equal(geteuid(), 0);
-    assert_int_equal(getegid(), 0);
-    assert_int_equal(getuid(), 0);
-    assert_int_equal(getgid(), 0);
-
-    talloc_free(saved_creds);
-    assert_true(check_leaks_pop(tmp_ctx));
-    talloc_free(tmp_ctx);
-
-    assert_true(leak_check_teardown());
-}
-
 int main(int argc, const char *argv[])
 {
     poptContext pc;
@@ -137,7 +82,6 @@ int main(int argc, const char *argv[])
 
     const struct CMUnitTest tests[] = {
         cmocka_unit_test(test_become_user),
-        cmocka_unit_test(test_switch_user),
     };
 
     /* Set debug level to invalid value so we can decide if -d 0 was used. */
diff --git a/src/tests/krb5_child-test.c b/src/tests/krb5_child-test.c
deleted file mode 100644
index 011a3bb1775..00000000000
--- a/src/tests/krb5_child-test.c
+++ /dev/null
@@ -1,518 +0,0 @@
-/*
-    SSSD
-
-    Unit tests - exercise the krb5 child
-
-    Authors:
-        Jakub Hrozek <jhrozek@redhat.com>
-
-    Copyright (C) 2012 Red Hat
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <talloc.h>
-#include <popt.h>
-#include <errno.h>
-#include <unistd.h>
-#include <limits.h>
-
-#include "util/util.h"
-
-/* Interfaces being tested */
-#include "providers/krb5/krb5_auth.h"
-#include "providers/krb5/krb5_common.h"
-#include "providers/krb5/krb5_utils.h"
-#include "providers/krb5/krb5_ccache.h"
-
-extern struct dp_option default_krb5_opts[];
-
-static krb5_context krb5_error_ctx;
-#define KRB5_CHILD_TEST_DEBUG(level, error) KRB5_DEBUG(level, krb5_error_ctx, error)
-
-#define CHECK_KRET_L(kret, err, label) do {     \
-    if (kret) {                                 \
-        KRB5_CHILD_TEST_DEBUG(SSSDBG_OP_FAILURE, kret);    \
-        goto label;                             \
-    }                                           \
-} while(0)                                      \
-
-struct krb5_child_test_ctx {
-    struct tevent_context *ev;
-    struct krb5child_req *kr;
-
-    bool done;
-    errno_t child_ret;
-
-    uint8_t *buf;
-    ssize_t len;
-    struct krb5_child_response *res;
-};
-
-static errno_t
-setup_krb5_child_test(TALLOC_CTX *mem_ctx, struct krb5_child_test_ctx **_ctx)
-{
-    struct krb5_child_test_ctx *ctx;
-
-    ctx = talloc_zero(mem_ctx, struct krb5_child_test_ctx);
-    if (!ctx) return ENOMEM;
-
-    ctx->ev = tevent_context_init(ctx);
-    if (ctx->ev == NULL) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "Could not init tevent context\n");
-        talloc_free(ctx);
-        return EFAULT;
-    }
-
-    *_ctx = ctx;
-    return EOK;
-}
-
-static struct krb5_ctx *
-create_dummy_krb5_ctx(TALLOC_CTX *mem_ctx, const char *realm)
-{
-    struct krb5_ctx *krb5_ctx;
-    int i;
-    errno_t ret;
-
-    krb5_ctx = talloc_zero(mem_ctx, struct krb5_ctx);
-    if (!krb5_ctx) return NULL;
-
-    ret = sss_regexp_new(krb5_ctx, ILLEGAL_PATH_PATTERN, 0, &(krb5_ctx->illegal_path_re));
-    if (ret != EOK) {
-        goto fail;
-    }
-
-    /* Kerberos options */
-    krb5_ctx->opts = talloc_zero_array(krb5_ctx, struct dp_option, KRB5_OPTS);
-    if (!krb5_ctx->opts) goto fail;
-    for (i = 0; i < KRB5_OPTS; i++) {
-        krb5_ctx->opts[i].opt_name = default_krb5_opts[i].opt_name;
-        krb5_ctx->opts[i].type = default_krb5_opts[i].type;
-        krb5_ctx->opts[i].def_val = default_krb5_opts[i].def_val;
-        switch (krb5_ctx->opts[i].type) {
-            case DP_OPT_STRING:
-                ret = dp_opt_set_string(krb5_ctx->opts, i,
-                                        default_krb5_opts[i].def_val.string);
-                break;
-            case DP_OPT_BLOB:
-                ret = dp_opt_set_blob(krb5_ctx->opts, i,
-                                      default_krb5_opts[i].def_val.blob);
-                break;
-            case DP_OPT_NUMBER:
-                ret = dp_opt_set_int(krb5_ctx->opts, i,
-                                     default_krb5_opts[i].def_val.number);
-                break;
-            case DP_OPT_BOOL:
-                ret = dp_opt_set_bool(krb5_ctx->opts, i,
-                                      default_krb5_opts[i].def_val.boolean);
-                break;
-        }
-        if (ret) goto fail;
-    }
-
-    ret = dp_opt_set_string(krb5_ctx->opts, KRB5_REALM, realm);
-    if (ret) goto fail;
-
-    return krb5_ctx;
-
-fail:
-    talloc_free(krb5_ctx);
-    return NULL;
-}
-
-static struct pam_data *
-create_dummy_pam_data(TALLOC_CTX *mem_ctx, const char *user,
-                      const char *password)
-{
-    struct pam_data *pd;
-    const char *authtok;
-    size_t authtok_len;
-    errno_t ret;
-
-    pd = create_pam_data(mem_ctx);
-    if (!pd) goto fail;
-
-    pd->cmd = SSS_PAM_AUTHENTICATE;
-    pd->user = talloc_strdup(pd, user);
-    if (!pd->user) goto fail;
-
-    ret = sss_authtok_set_password(pd->authtok, password, 0);
-    if (ret) goto fail;
-
-    (void)sss_authtok_get_password(pd->authtok, &authtok, &authtok_len);
-    DEBUG(SSSDBG_FUNC_DATA, "Authtok [%s] len [%d]\n",
-                             authtok, (int)authtok_len);
-
-    return pd;
-
-fail:
-    talloc_free(pd);
-    return NULL;
-}
-
-static struct krb5child_req *
-create_dummy_req(TALLOC_CTX *mem_ctx, const char *user,
-                 const char *password, const char *realm,
-                 const char *ccname, const char *ccname_template,
-                 int timeout)
-{
-    struct krb5child_req *kr;
-    struct passwd *pwd;
-    errno_t ret;
-
-    /* The top level child request */
-    kr = talloc_zero(mem_ctx, struct krb5child_req);
-    if (!kr) return NULL;
-
-    pwd = getpwnam(user);
-    if (!pwd) {
-        DEBUG(SSSDBG_FATAL_FAILURE,
-              "Cannot get info on user [%s]\n", user);
-        goto fail;
-    }
-
-    kr->uid = pwd->pw_uid;
-    kr->gid = pwd->pw_gid;
-
-    /* The Kerberos context */
-    kr->krb5_ctx = create_dummy_krb5_ctx(kr, realm);
-    if (!kr->krb5_ctx) {
-        DEBUG(SSSDBG_FATAL_FAILURE,
-              "Failed to create dummy krb5_ctx\n");
-        goto fail;
-    }
-    /* PAM Data structure */
-    kr->pd = create_dummy_pam_data(kr, user, password);
-    if (!kr->pd) {
-        DEBUG(SSSDBG_FATAL_FAILURE,
-              "Failed to create dummy pam_data");
-        goto fail;
-    }
-
-    ret = krb5_get_simple_upn(kr, kr->krb5_ctx, NULL, kr->pd->user, NULL,
-                              &kr->upn);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, "krb5_get_simple_upn failed.\n");
-        goto fail;
-    }
-
-    /* Override options with what was provided by the user */
-    if (ccname_template) {
-        ret = dp_opt_set_string(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL,
-                                ccname_template);
-        if (ret != EOK) goto fail;
-    }
-
-    if (timeout) {
-        ret = dp_opt_set_int(kr->krb5_ctx->opts, KRB5_AUTH_TIMEOUT, timeout);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to set value for krb5_auth_timeout\n");
-            goto fail;
-        }
-    }
-
-    if (!ccname) {
-        kr->ccname = expand_ccname_template(kr, kr,
-                                        dp_opt_get_cstring(kr->krb5_ctx->opts,
-                                                           KRB5_CCNAME_TMPL),
-                                            kr->krb5_ctx->illegal_path_re, true, true);
-        if (!kr->ccname) goto fail;
-
-        DEBUG(SSSDBG_FUNC_DATA, "ccname [%s] uid [%llu] gid [%llu]\n",
-              kr->ccname, (unsigned long long) kr->uid,
-              (unsigned long long) kr->gid);
-    } else {
-        kr->ccname = talloc_strdup(kr, ccname);
-    }
-    if (!kr->ccname) goto fail;
-
-    DEBUG(SSSDBG_FUNC_DATA, "ccname [%s] uid [%u] gid [%u]\n",
-            kr->ccname, kr->uid, kr->gid);
-
-    return kr;
-
-fail:
-    talloc_free(kr);
-    return NULL;
-}
-
-static void
-child_done(struct tevent_req *req)
-{
-    struct krb5_child_test_ctx *ctx = tevent_req_callback_data(req,
-                                    struct krb5_child_test_ctx);
-    errno_t ret;
-
-    ret = handle_child_recv(req, ctx, &ctx->buf, &ctx->len);
-    talloc_free(req);
-    ctx->done = true;
-    ctx->child_ret = ret;
-}
-
-static void
-printtime(krb5_timestamp ts)
-{
-    krb5_error_code kret;
-    char timestring[BUFSIZ];
-    char fill = '\0';
-
-#ifdef HAVE_KRB5_TIMESTAMP_TO_SFSTRING
-    kret = krb5_timestamp_to_sfstring(ts, timestring, BUFSIZ, &fill);
-    if (kret) {
-        KRB5_CHILD_TEST_DEBUG(SSSDBG_OP_FAILURE, kret);
-    }
-    printf("%s", timestring);
-#else
-    printf("%s", ctime(&ts));
-#endif /* HAVE_KRB5_TIMESTAMP_TO_SFSTRING */
-}
-
-static void
-print_creds(krb5_context kcontext, krb5_creds *cred, const char *defname)
-{
-    krb5_error_code kret;
-    char *name = NULL;
-    char *sname = NULL;
-
-    kret = krb5_unparse_name(kcontext, cred->client, &name);
-    CHECK_KRET_L(kret, EIO, done);
-
-    kret = krb5_unparse_name(kcontext, cred->server, &sname);
-    CHECK_KRET_L(kret, EIO, done);
-
-    if (!cred->times.starttime) {
-        cred->times.starttime = cred->times.authtime;
-    }
-
-
-    printf("\t\t%s\n", sname);
-    printf("\t\tValid from\t");  printtime(cred->times.starttime);
-    printf("\n\t\tValid until\t"); printtime(cred->times.endtime);
-    printf("\n");
-
-    if (strcmp(name, defname)) {
-        printf("\t\tfor client %s", name);
-    }
-
-done:
-    krb5_free_unparsed_name(kcontext, name);
-    krb5_free_unparsed_name(kcontext, sname);
-}
-
-static errno_t
-print_ccache(const char *cc)
-{
-    krb5_cc_cursor cur;
-    krb5_ccache cache = NULL;
-    krb5_error_code kret;
-    krb5_context kcontext = NULL;
-    krb5_principal_data *princ = NULL;
-    krb5_creds creds;
-    char *defname = NULL;
-    int i = 1;
-    errno_t ret = EIO;
-
-    kret = krb5_init_context(&kcontext);
-    CHECK_KRET_L(kret, EIO, done);
-
-    kret = krb5_cc_resolve(kcontext, cc, &cache);
-    CHECK_KRET_L(kret, EIO, done);
-
-    kret = krb5_cc_get_principal(kcontext, cache, &princ);
-    CHECK_KRET_L(kret, EIO, done);
-
-    kret = krb5_unparse_name(kcontext, princ, &defname);
-    CHECK_KRET_L(kret, EIO, done);
-
-    printf("\nTicket cache: %s:%s\nDefault principal: %s\n\n",
-           krb5_cc_get_type(kcontext, cache),
-           krb5_cc_get_name(kcontext, cache), defname);
-
-    kret = krb5_cc_start_seq_get(kcontext, cache, &cur);
-    CHECK_KRET_L(kret, EIO, done);
-
-    while (!(kret = krb5_cc_next_cred(kcontext, cache, &cur, &creds))) {
-        printf("Ticket #%d:\n", i);
-        print_creds(kcontext, &creds, defname);
-        krb5_free_cred_contents(kcontext, &creds);
-    }
-
-    kret = krb5_cc_end_seq_get(kcontext, cache, &cur);
-    CHECK_KRET_L(kret, EIO, done);
-
-    ret = EOK;
-done:
-    krb5_cc_close(kcontext, cache);
-    krb5_free_unparsed_name(kcontext, defname);
-    krb5_free_principal(kcontext, princ);
-    krb5_free_context(kcontext);
-    return ret;
-}
-
-int
-main(int argc, const char *argv[])
-{
-    int opt;
-    errno_t ret;
-    struct krb5_child_test_ctx *ctx = NULL;
-    struct tevent_req *req;
-
-    int pc_debug = 0;
-    int pc_timeout = 0;
-    const char *pc_user = NULL;
-    const char *pc_passwd = NULL;
-    const char *pc_realm = NULL;
-    const char *pc_ccname = NULL;
-    const char *pc_ccname_tp = NULL;
-    char *password = NULL;
-    bool rm_ccache = true;
-
-    poptContext pc;
-    struct poptOption long_options[] = {
-        POPT_AUTOHELP
-        { "debug", '\0', POPT_ARG_INT | POPT_ARGFLAG_DOC_HIDDEN, &pc_debug, 0,
-          "The debug level to run with", NULL },
-        { "user", 'u', POPT_ARG_STRING, &pc_user, 0,
-          "The user to log in as", NULL },
-        { "password", 'w', POPT_ARG_STRING, &pc_passwd, 0,
-          "The authtok to use", NULL },
-        { "ask-password", 'W', POPT_ARG_NONE, NULL, 'W',
-          "Ask interactively for authtok", NULL },
-        { "ccname", 'c', POPT_ARG_STRING, &pc_ccname, 0,
-           "Force usage of a certain credential cache", NULL },
-        { "ccname-template", 't', POPT_ARG_STRING, &pc_ccname_tp, 0,
-           "Specify the credential cache template", NULL },
-        { "realm", 'r', POPT_ARG_STRING, &pc_realm, 0,
-          "The Kerberos realm to use", NULL },
-        { "keep-ccache", 'k', POPT_ARG_NONE, NULL, 'k',
-          "Do not delete the ccache when the tool finishes", NULL },
-        { "timeout", '\0', POPT_ARG_INT, &pc_timeout, 0,
-          "The timeout for the child, in seconds", NULL },
-        POPT_TABLEEND
-    };
-
-    debug_prg_name = argv[0];
-    pc = poptGetContext(NULL, argc, argv, long_options, 0);
-
-    while ((opt = poptGetNextOpt(pc)) > 0) {
-        switch(opt) {
-        case 'W':
-            errno = 0;
-            password = getpass("Enter password:");
-            if (!password) {
-                return 1;
-            }
-            break;
-        case 'k':
-            rm_ccache = false;
-            break;
-        default:
-            DEBUG(SSSDBG_FATAL_FAILURE, "Unexpected option\n");
-            return 1;
-        }
-    }
-
-    DEBUG_CLI_INIT(pc_debug);
-
-    if (opt != -1) {
-        poptPrintUsage(pc, stderr, 0);
-        fprintf(stderr, "%s", poptStrerror(opt));
-        return 1;
-    }
-
-    if (!pc_user) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "Please specify the user\n");
-        poptPrintUsage(pc, stderr, 0);
-        return 1;
-    }
-
-    if (!pc_realm) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "Please specify the realm\n");
-        poptPrintUsage(pc, stderr, 0);
-        return 1;
-    }
-
-    if (!password && !pc_passwd) {
-        DEBUG(SSSDBG_FATAL_FAILURE,
-              "Password was not provided or asked for\n");
-        poptPrintUsage(pc, stderr, 0);
-        return 1;
-    }
-
-    if (pc_ccname && pc_ccname_tp) {
-        DEBUG(SSSDBG_MINOR_FAILURE,
-              "Both ccname and ccname template specified, "
-               "will prefer ccname\n");
-    }
-
-    ret = setup_krb5_child_test(NULL, &ctx);
-    if (ret != EOK) {
-        poptPrintUsage(pc, stderr, 0);
-        fprintf(stderr, "%s", poptStrerror(opt));
-        return 3;
-    }
-
-    ctx->kr = create_dummy_req(ctx, pc_user, password ? password : pc_passwd,
-                               pc_realm, pc_ccname, pc_ccname_tp, pc_timeout);
-    if (!ctx->kr) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "Cannot create Kerberos request\n");
-        ret = 4;
-        goto done;
-    }
-
-    req = handle_child_send(ctx, ctx->ev, ctx->kr);
-    if (!req) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "Cannot create child request\n");
-        ret = 4;
-        goto done;
-    }
-    tevent_req_set_callback(req, child_done, ctx);
-
-    while (ctx->done == false) {
-         tevent_loop_once(ctx->ev);
-    }
-
-    printf("Child returned %d\n", ctx->child_ret);
-
-    ret = parse_krb5_child_response(ctx, ctx->buf, ctx->len,
-                                    ctx->kr->pd, 0, &ctx->res);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "Could not parse child response\n");
-        ret = 5;
-        goto done;
-    }
-
-    if (!ctx->res->ccname) {
-        fprintf(stderr, "No ccname returned\n");
-        ret = 6;
-        goto done;
-    }
-
-    print_ccache(ctx->res->ccname);
-
-    ret = 0;
-done:
-    if (rm_ccache && ctx->res
-            && ctx->res->ccname
-            && ctx->kr) {
-        sss_krb5_cc_destroy(ctx->res->ccname, ctx->kr->uid, ctx->kr->gid);
-    }
-    free(password);
-    talloc_free(ctx);
-    poptFreeContext(pc);
-    return ret;
-}
diff --git a/src/util/become_user.c b/src/util/become_user.c
index d2bd7cfd12c..2d9359a2bd6 100644
--- a/src/util/become_user.c
+++ b/src/util/become_user.c
@@ -73,143 +73,3 @@ errno_t become_user(uid_t uid, gid_t gid, bool keep_set_uid)
 
     return ret;
 }
-
-struct sss_creds {
-    uid_t uid;
-    gid_t gid;
-    int num_gids;
-    gid_t gids[];
-};
-
-errno_t restore_creds(struct sss_creds *saved_creds);
-
-/* This is a reversible version of become_user, and returns the saved
- * credentials so that creds can be switched back calling restore_creds */
-errno_t switch_creds(TALLOC_CTX *mem_ctx,
-                     uid_t uid, gid_t gid,
-                     int num_gids, gid_t *gids,
-                     struct sss_creds **saved_creds)
-{
-    struct sss_creds *ssc = NULL;
-    int size;
-    int ret;
-    uid_t myuid;
-    uid_t mygid;
-
-    DEBUG(SSSDBG_FUNC_DATA, "Switch user to [%d][%d].\n", uid, gid);
-
-    myuid = geteuid();
-    mygid = getegid();
-
-    if (saved_creds) {
-        /* save current user credentials */
-        size = getgroups(0, NULL);
-        if (size == -1) {
-            ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE, "Getgroups failed! (%d, %s)\n",
-                                        ret, strerror(ret));
-            goto done;
-        }
-
-        ssc = talloc_size(mem_ctx,
-                          (sizeof(struct sss_creds) + size * sizeof(gid_t)));
-        if (!ssc) {
-            DEBUG(SSSDBG_CRIT_FAILURE, "Allocation failed!\n");
-            ret = ENOMEM;
-            goto done;
-        }
-        ssc->num_gids = size;
-
-        size = getgroups(ssc->num_gids, ssc->gids);
-        if (size == -1) {
-            ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE, "Getgroups failed! (%d, %s)\n",
-                                        ret, strerror(ret));
-            /* free ssc immediately otherwise the code will try to restore
-             * wrong creds */
-            talloc_zfree(ssc);
-            goto done;
-        }
-
-        /* we care only about effective ids */
-        ssc->uid = myuid;
-        ssc->gid = mygid;
-    }
-
-    /* if we are regaining root, set EUID first so that we have CAP_SETUID back,
-     * and the other calls work too, otherwise call it last so that we can
-     * change groups before we loose CAP_SETUID */
-    if (uid == 0) {
-        ret = setresuid(0, 0, 0);
-        if (ret == -1) {
-            ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "setresuid failed [%d][%s].\n", ret, strerror(ret));
-            goto done;
-        }
-    }
-
-    /* TODO: use libcap-ng if we need to get/set capabilities too? */
-
-    if (myuid == uid && mygid == gid) {
-        DEBUG(SSSDBG_FUNC_DATA, "Already user [%"SPRIuid"].\n", uid);
-        talloc_zfree(ssc);
-        return EOK;
-    }
-
-    /* try to setgroups first should always work if CAP_SETUID is set,
-     * otherwise it will always fail, failure is not critical though as
-     * generally we only really care about UID and at most primary GID */
-    ret = setgroups(num_gids, gids);
-    if (ret == -1) {
-        ret = errno;
-        DEBUG(SSSDBG_TRACE_FUNC,
-              "setgroups failed [%d][%s].\n", ret, strerror(ret));
-    }
-
-    /* change GID now, (leaves saved GID to current, so we can restore) */
-    ret = setresgid(-1, gid, -1);
-    if (ret == -1) {
-        ret = errno;
-        DEBUG(SSSDBG_CRIT_FAILURE,
-              "setresgid failed [%d][%s].\n", ret, strerror(ret));
-        goto done;
-    }
-
-    if (uid != 0) {
-        /* change UID, (leaves saved UID to current, so we can restore) */
-        ret = setresuid(-1, uid, -1);
-        if (ret == -1) {
-            ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "setresuid failed [%d][%s].\n", ret, strerror(ret));
-            goto done;
-        }
-    }
-
-    ret = 0;
-
-done:
-    if (ret) {
-        /* attempt to restore creds first */
-        restore_creds(ssc);
-        talloc_free(ssc);
-    } else if (saved_creds) {
-        *saved_creds = ssc;
-    }
-    return ret;
-}
-
-errno_t restore_creds(struct sss_creds *saved_creds)
-{
-    if (saved_creds == NULL) {
-        /* In case save_creds was saved with the UID already dropped */
-        return EOK;
-    }
-
-    return switch_creds(saved_creds,
-                        saved_creds->uid,
-                        saved_creds->gid,
-                        saved_creds->num_gids,
-                        saved_creds->gids, NULL);
-}
diff --git a/src/util/util.h b/src/util/util.h
index 3c2b032088e..0c5efa03130 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -738,12 +738,8 @@ errno_t mod_defaults_list(TALLOC_CTX *mem_ctx, const char **defaults_list,
 
 /* from become_user.c */
 errno_t become_user(uid_t uid, gid_t gid, bool keep_set_uid);
-struct sss_creds;
-errno_t switch_creds(TALLOC_CTX *mem_ctx,
-                     uid_t uid, gid_t gid,
-                     int num_gids, gid_t *gids,
-                     struct sss_creds **saved_creds);
-errno_t restore_creds(struct sss_creds *saved_creds);
+
+/* from capabilities.c */
 errno_t sss_log_caps_to_str(bool only_non_zero, char **_str);
 errno_t sss_set_cap_effective(cap_value_t cap, bool effective);
 errno_t sss_drop_cap(cap_value_t cap);

From 19a871a9e9f426c8be0c6760a8653a057d05b5fb Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 27 Nov 2024 15:42:45 +0100
Subject: [PATCH 123/129] KRB5: 'krb5_child' doesn't require effective
 capabilities
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am          | 2 +-
 contrib/sssd.spec.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 7d1ea270471..eed526250e3 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5554,7 +5554,7 @@ if SSSD_USER
 	-$(SETCAP) cap_dac_read_search=p $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
-	-$(SETCAP) cap_dac_read_search,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
+	-$(SETCAP) cap_dac_read_search,cap_setuid,cap_setgid=p $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child
 	chmod 750 $(DESTDIR)$(sssdlibexecdir)/proxy_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/sssd_pam
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 66798a3fa68..9700c7210b0 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -914,7 +914,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %license COPYING
 %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
 %attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=p) %{_libexecdir}/%{servicename}/ldap_child
-%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child
+%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search,cap_setuid,cap_setgid=p) %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang
 %license COPYING

From 988e5fa846e928508cbcda3dee9f21943ad4949d Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 27 Nov 2024 16:16:59 +0100
Subject: [PATCH 124/129] become_user() moved to src/monitor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Monitor is the only user of this function and only if built
with support of deprecated 'sssd.conf::user' option.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 Makefile.am                         | 10 +++++-----
 src/{util => monitor}/become_user.c |  0
 src/monitor/monitor_bootstrap.c     |  2 ++
 src/tests/cwrap/test_become_user.c  |  2 +-
 src/util/util.h                     |  3 ---
 5 files changed, 8 insertions(+), 9 deletions(-)
 rename src/{util => monitor}/become_user.c (100%)

diff --git a/Makefile.am b/Makefile.am
index eed526250e3..38d3797419b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1300,7 +1300,6 @@ libsss_util_la_SOURCES = \
     src/util/util_sss_idmap.c \
     src/util/well_known_sids.c \
     src/util/string_utils.c \
-    src/util/become_user.c \
     src/util/capabilities.c \
     src/util/util_watchdog.c \
     src/util/sss_ptr_hash.c \
@@ -1528,6 +1527,11 @@ sssd_SOURCES = \
     src/monitor/nscd.c \
     src/confdb/confdb_setup.c \
     $(NULL)
+
+if BUILD_CONF_SERVICE_USER_SUPPORT
+sssd_SOURCES += src/monitor/become_user.c
+endif # BUILD_CONF_SERVICE_USER_SUPPORT
+
 sssd_LDADD = \
     $(SSSD_LIBS) \
     $(INOTIFY_LIBS) \
@@ -2208,7 +2212,6 @@ krb5_utils_tests_SOURCES = \
     src/providers/data_provider_fo.c \
     src/providers/data_provider_opts.c \
     src/providers/data_provider_callbacks.c \
-    src/util/become_user.c \
     $(SSSD_FAILOVER_OBJ) \
     $(NULL)
 krb5_utils_tests_CFLAGS = \
@@ -4373,7 +4376,6 @@ libsss_krb5_common_la_SOURCES = \
     src/providers/krb5/krb5_ccache.c \
     src/util/sss_krb5.c \
     src/util/sss_iobuf.c \
-    src/util/become_user.c \
     src/util/pac_utils.c \
     $(NULL)
 libsss_krb5_common_la_CFLAGS = \
@@ -4684,7 +4686,6 @@ krb5_child_SOURCES = \
     src/util/signal.c \
     src/util/sss_chain_id.c \
     src/util/strtonum.c \
-    src/util/become_user.c \
     src/util/util_errors.c \
     src/sss_client/common.c \
     src/krb5_plugin/common/utils.c \
@@ -4727,7 +4728,6 @@ ldap_child_SOURCES = \
     src/util/util_ext.c \
     src/util/capabilities.c \
     src/util/signal.c \
-    src/util/become_user.c \
     src/util/util_errors.c \
     $(NULL)
 ldap_child_CFLAGS = \
diff --git a/src/util/become_user.c b/src/monitor/become_user.c
similarity index 100%
rename from src/util/become_user.c
rename to src/monitor/become_user.c
diff --git a/src/monitor/monitor_bootstrap.c b/src/monitor/monitor_bootstrap.c
index 0e28141e207..fa7866789bb 100644
--- a/src/monitor/monitor_bootstrap.c
+++ b/src/monitor/monitor_bootstrap.c
@@ -78,6 +78,8 @@ static int check_supplementary_group(gid_t gid)
 #endif /* SSSD_NON_ROOT_USER */
 
 #ifdef BUILD_CONF_SERVICE_USER_SUPPORT
+errno_t become_user(uid_t uid, gid_t gid, bool keep_set_uid);
+
 int bootstrap_monitor_process(uid_t target_uid, gid_t target_gid)
 #else
 int bootstrap_monitor_process(void)
diff --git a/src/tests/cwrap/test_become_user.c b/src/tests/cwrap/test_become_user.c
index 1df6e3c06f8..53dd582c419 100644
--- a/src/tests/cwrap/test_become_user.c
+++ b/src/tests/cwrap/test_become_user.c
@@ -21,7 +21,7 @@
 */
 
 /* Yes, a .c file. We need to call static functions during the test */
-#include "../../../src/util/become_user.c"
+#include "../../../src/monitor/become_user.c"
 
 #include <popt.h>
 #include "util/util.h"
diff --git a/src/util/util.h b/src/util/util.h
index 0c5efa03130..58d7e0a00b3 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -736,9 +736,6 @@ char **concatenate_string_array(TALLOC_CTX *mem_ctx,
 errno_t mod_defaults_list(TALLOC_CTX *mem_ctx, const char **defaults_list,
                           char **mod_list, char ***_list);
 
-/* from become_user.c */
-errno_t become_user(uid_t uid, gid_t gid, bool keep_set_uid);
-
 /* from capabilities.c */
 errno_t sss_log_caps_to_str(bool only_non_zero, char **_str);
 errno_t sss_set_cap_effective(cap_value_t cap, bool effective);

From a406c1b2890b37ac640eef681519087bb2aa27b8 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Wed, 4 Dec 2024 13:53:58 +0100
Subject: [PATCH 125/129] KRB5: cosmetics
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove non existent / private functions from a header.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Scott Poore <spoore@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 src/providers/krb5/krb5_ccache.c | 2 +-
 src/providers/krb5/krb5_ccache.h | 5 -----
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/src/providers/krb5/krb5_ccache.c b/src/providers/krb5/krb5_ccache.c
index e86e7a90227..67de16bf786 100644
--- a/src/providers/krb5/krb5_ccache.c
+++ b/src/providers/krb5/krb5_ccache.c
@@ -276,7 +276,7 @@ static errno_t sss_destroy_ccache(struct sss_krb5_ccache *cc)
     return ret;
 }
 
-errno_t sss_krb5_cc_destroy(const char *ccname)
+static errno_t sss_krb5_cc_destroy(const char *ccname)
 {
     struct sss_krb5_ccache *cc = NULL;
     TALLOC_CTX *tmp_ctx;
diff --git a/src/providers/krb5/krb5_ccache.h b/src/providers/krb5/krb5_ccache.h
index c5aa56c72c1..317e55080d9 100644
--- a/src/providers/krb5/krb5_ccache.h
+++ b/src/providers/krb5/krb5_ccache.h
@@ -37,8 +37,6 @@ struct tgt_times {
 
 errno_t sss_krb5_precheck_ccache(const char *ccname, uid_t uid, gid_t gid);
 
-errno_t sss_krb5_cc_destroy(const char *ccname);
-
 errno_t sss_krb5_check_ccache_princ(krb5_context kctx,
                                     const char *ccname,
                                     krb5_principal user_princ);
@@ -46,9 +44,6 @@ errno_t sss_krb5_check_ccache_princ(krb5_context kctx,
 errno_t sss_krb5_cc_verify_ccache(const char *ccname, const char *realm,
                                   const char *principal);
 
-errno_t get_ccache_file_data(const char *ccache_file, const char *client_name,
-                             struct tgt_times *tgtt);
-
 errno_t safe_remove_old_ccache_file(const char *old_ccache,
                                     const char *new_ccache);
 

From 20d658bfbadb47b9393142a9eb607d99bfda92f4 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 3 Dec 2024 18:25:39 +0100
Subject: [PATCH 126/129] Deprecate and make support of
 'ad_allow_remote_domain_local_groups'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sssd.conf option conditional

:config: 'ad_allow_remote_domain_local_groups' option is deprecated
and will be removed in future releases.

:packaging: Support of deprecated 'ad_allow_remote_domain_local_groups'
sssd.conf option isn't built by default. It can be enabled using
'--with-allow-remote-domain-local-groups' ./configure option.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
---
 configure.ac                 |  1 +
 contrib/sssd.spec.in         |  1 +
 src/conf_macros.m4           | 17 +++++++++++++++++
 src/man/Makefile.am          |  5 ++++-
 src/man/sssd-ad.5.xml        |  5 ++++-
 src/providers/ad/ad_common.c |  4 ++++
 src/providers/ad/ad_common.h |  2 ++
 src/providers/ad/ad_opts.c   |  2 ++
 8 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/configure.ac b/configure.ac
index a7f06855f0d..90cb1f3ecec 100644
--- a/configure.ac
+++ b/configure.ac
@@ -182,6 +182,7 @@ WITH_SUDO_LIB_PATH
 WITH_AUTOFS
 WITH_FILES_PROVIDER
 WITH_EXTENDED_ENUMERATION_SUPPORT
+WITH_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS
 WITH_CONF_SERVICE_USER_SUPPORT
 WITH_SUBID
 WITH_SUBID_LIB_PATH
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 9700c7210b0..9f114ac925e 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -614,6 +614,7 @@ autoreconf -ivf
     --with-files-provider \
     --with-extended-enumeration-support \
     --with-ssh-known-hosts-proxy \
+    --with-allow-remote-domain-local-groups \
 %endif
 %if %{build_subid}
     --with-subid \
diff --git a/src/conf_macros.m4 b/src/conf_macros.m4
index 6ece1c79be9..ded342213e0 100644
--- a/src/conf_macros.m4
+++ b/src/conf_macros.m4
@@ -661,6 +661,23 @@ AC_DEFUN([WITH_EXTENDED_ENUMERATION_SUPPORT],
     AM_CONDITIONAL([BUILD_EXTENDED_ENUMERATION_SUPPORT], [test x"$with_extended_enumeration_support" = xyes])
   ])
 
+AC_DEFUN([WITH_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS],
+  [ AC_ARG_WITH([allow-remote-domain-local-groups],
+                [AC_HELP_STRING([--with-allow-remote-domain-local-groups],
+                                [Whether to build support of deprecated ad_allow_remote_domain_local_groups
+                                 sssd.conf option [no].]
+                               )
+                ],
+                [with_allow_remote_domain_local_groups=$withval],
+                with_allow_remote_domain_local_groups=no
+               )
+
+    if test x"$with_allow_remote_domain_local_groups" = xyes; then
+        AC_DEFINE(BUILD_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS, 1, [Whether to build support of deprecated ad_allow_remote_domain_local_groups sssd.conf option])
+    fi
+    AM_CONDITIONAL([BUILD_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS], [test x"$with_allow_remote_domain_local_groups" = xyes])
+  ])
+
 AC_DEFUN([WITH_SUBID],
   [ AC_ARG_WITH([subid],
                 [AC_HELP_STRING([--with-subid],
diff --git a/src/man/Makefile.am b/src/man/Makefile.am
index fcbd086e76d..2a15254afa8 100644
--- a/src/man/Makefile.am
+++ b/src/man/Makefile.am
@@ -60,6 +60,9 @@ ENUM_CONDS = ;with_ext_enumeration
 else
 ENUM_CONDS = ;without_ext_enumeration
 endif
+if BUILD_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS
+AD_CONDS = ;with_allow_remote_domain_local_groups
+endif
 if SSSD_NON_ROOT_USER
 SSSD_NON_ROOT_USER_CONDS = ;with_non_root_user_support
 if BUILD_CONF_SERVICE_USER_SUPPORT
@@ -73,7 +76,7 @@ LIBNL_CONDS = ;have_libnl
 endif
 
 
-CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(SSH_KNOWN_HOSTS_PROXY_CONDS)$(PAC_RESPONDER_CONDS)$(GPO_CONDS)$(SYSTEMD_CONDS)$(KCM_CONDS)$(STAP_CONDS)$(KCM_RENEWAL_CONDS)$(LOCKFREE_CLIENT_CONDS)$(HAVE_INOTIFY_CONDS)$(PASSKEY_CONDS)$(FILES_PROVIDER_CONDS)$(SSSD_NON_ROOT_USER_CONDS)$(SSSD_CONF_SERVICE_USER_CONDS)$(ENUM_CONDS)$(LIBNL_CONDS)
+CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(SSH_KNOWN_HOSTS_PROXY_CONDS)$(PAC_RESPONDER_CONDS)$(GPO_CONDS)$(SYSTEMD_CONDS)$(KCM_CONDS)$(STAP_CONDS)$(KCM_RENEWAL_CONDS)$(LOCKFREE_CLIENT_CONDS)$(HAVE_INOTIFY_CONDS)$(PASSKEY_CONDS)$(FILES_PROVIDER_CONDS)$(SSSD_NON_ROOT_USER_CONDS)$(SSSD_CONF_SERVICE_USER_CONDS)$(ENUM_CONDS)$(LIBNL_CONDS)$(AD_CONDS)
 
 
 #Special Rules:
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 67239917dd1..4fc937609ae 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -1129,9 +1129,12 @@ ad_gpo_map_deny = +my_pam_service
                     </listitem>
                 </varlistentry>
 
-                <varlistentry>
+                <varlistentry condition="with_allow_remote_domain_local_groups">
                     <term>ad_allow_remote_domain_local_groups (boolean)</term>
                     <listitem>
+                        <para>
+                            This option is deprecated.
+                        </para>
                         <para>
                             If this option is set to <quote>true</quote> SSSD
                             will not filter out Domain Local groups from remote
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
index 6215b64831b..48e3b811477 100644
--- a/src/providers/ad/ad_common.c
+++ b/src/providers/ad/ad_common.c
@@ -1199,8 +1199,12 @@ ad_set_sdap_options(struct ad_options *ad_opts,
                keytab_path);
     }
 
+#ifdef BUILD_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS
     id_opts->allow_remote_domain_local_groups = dp_opt_get_bool(ad_opts->basic,
                                                   AD_ALLOW_REMOTE_DOMAIN_LOCAL);
+#else
+    id_opts->allow_remote_domain_local_groups = false;
+#endif
 
     ret = sdap_set_sasl_options(id_opts,
                                 dp_opt_get_string(ad_opts->basic,
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
index 99cebe2e27c..1c8d60e0c23 100644
--- a/src/providers/ad/ad_common.h
+++ b/src/providers/ad/ad_common.h
@@ -70,7 +70,9 @@ enum ad_basic_opt {
     AD_MACHINE_ACCOUNT_PASSWORD_RENEWAL_OPTS,
     AD_UPDATE_SAMBA_MACHINE_ACCOUNT_PASSWORD,
     AD_USE_LDAPS,
+#ifdef BUILD_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS
     AD_ALLOW_REMOTE_DOMAIN_LOCAL,
+#endif
 
     AD_OPTS_BASIC /* opts counter */
 };
diff --git a/src/providers/ad/ad_opts.c b/src/providers/ad/ad_opts.c
index a3dd0547b7a..5fb26c4f2c8 100644
--- a/src/providers/ad/ad_opts.c
+++ b/src/providers/ad/ad_opts.c
@@ -58,7 +58,9 @@ struct dp_option ad_basic_opts[] = {
     { "ad_machine_account_password_renewal_opts", DP_OPT_STRING, { "86400:750:300" }, NULL_STRING },
     { "ad_update_samba_machine_account_password", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ad_use_ldaps", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+#ifdef BUILD_ALLOW_REMOTE_DOMAIN_LOCAL_GROUPS
     { "ad_allow_remote_domain_local_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+#endif
     DP_OPTION_TERMINATOR
 };
 

From 110c4aead0d6f1f147bd3dc741528ce2cba5bedc Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 6 Dec 2024 13:57:54 +0100
Subject: [PATCH 127/129] KRB5: mistype fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes:
```
 *** CID 515655:  Uninitialized variables  (UNINIT)
 /home/runner/work/sssd/sssd/src/providers/krb5/krb5_child.c: 2435 in
 get_and_save_tgt()
 2429             goto done;
 2430         }
 2431
 2432         /* Make sure ccache is created and written as the user */
 2433         kerr = switch_to_user();
 2434         if (kerr != EOK) {
  >>>     CID 515655:  Uninitialized variables  (UNINIT)
  >>>     Using uninitialized value "ret" when calling "sss_debug_fn".
 2435             DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to user
 IDs: %d\n", ret);
 2436             goto done;
 2437         }
 2438
 2439         log_process_caps("Saving ccache");
 2440
```

Reviewed-by: Jakub Vávra <jvavra@redhat.com>
---
 src/providers/krb5/krb5_child.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 7c91d62715e..0c4f92e9f0f 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -2432,7 +2432,7 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
     /* Make sure ccache is created and written as the user */
     kerr = switch_to_user();
     if (kerr != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to user IDs: %d\n", ret);
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to switch to user IDs: %d\n", kerr);
         goto done;
     }
 

From 8c86abd6d6fb1456bb743e031e27802cd7aea490 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 11 Nov 2024 18:42:09 +0100
Subject: [PATCH 128/129] ldap: make sure realm is set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In general the canonical principal will be only set in the cache after a
successful authentication because in general it is not know what the
canonical principal might be.

For Active Directory it is known that the canonical principal is build
with the sAMAccountName attribute and the Kerberos realm which is used
in the patch "AD: Construct UPN from the sAMAccountName" (7a27e539). If
'id_provider = ldap' is used to access Active Directory the realm might
not be set in the internal domain data and as a result a wrong principal
might be created. This patch makes sure the realm is set before creating
the canonical principal.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
---
 src/providers/ldap/sdap_async_users.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
index 9dd88f9de9b..4d947530f10 100644
--- a/src/providers/ldap/sdap_async_users.c
+++ b/src/providers/ldap/sdap_async_users.c
@@ -204,7 +204,7 @@ int sdap_save_user(TALLOC_CTX *memctx,
     size_t c;
     char *p1;
     char *p2;
-    char *new_upn;
+    char *new_upn = NULL;
     bool is_posix = true;
 
     DEBUG(SSSDBG_TRACE_FUNC, "Save user\n");
@@ -278,8 +278,10 @@ int sdap_save_user(TALLOC_CTX *memctx,
                                    &samaccountname);
         if (ret == EOK) {
             ret = ENOENT;
-            new_upn = talloc_asprintf(memctx, "%s@%s", samaccountname,
-                                      dom->realm);
+            if (dom->realm != NULL) {
+                new_upn = talloc_asprintf(memctx, "%s@%s", samaccountname,
+                                          dom->realm);
+            }
             if (new_upn != NULL){
                 ret = sysdb_attrs_add_string(user_attrs,
                                              SYSDB_CANONICAL_UPN, new_upn);

From ef535319cc90797464a99e99e7b9d86533b76db8 Mon Sep 17 00:00:00 2001
From: Madhuri Upadhye <mupadhye@redhat.com>
Date: Fri, 15 Nov 2024 19:53:10 +0530
Subject: [PATCH 129/129] Test: Add the test when we replace id_provider
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With AD/Samba check the authentication of user
by replacing id_provider = ldap

Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>
Reviewed-by: Jakub Vávra <jvavra@redhat.com>
---
 src/tests/system/tests/test_ad.py | 70 +++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 src/tests/system/tests/test_ad.py

diff --git a/src/tests/system/tests/test_ad.py b/src/tests/system/tests/test_ad.py
new file mode 100644
index 00000000000..53695f90a4c
--- /dev/null
+++ b/src/tests/system/tests/test_ad.py
@@ -0,0 +1,70 @@
+"""
+SSSD AD Provider Test Cases
+
+:requirement: ad
+"""
+
+from __future__ import annotations
+
+import pytest
+from sssd_test_framework.roles.client import Client
+from sssd_test_framework.roles.generic import GenericADProvider
+from sssd_test_framework.topology import KnownTopologyGroup
+
+
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+@pytest.mark.ticket(jira="RHEL-65848", gh=7690)
+@pytest.mark.parametrize("method", ["su", "ssh"])
+@pytest.mark.importance("high")
+def test_ad__user_authentication_when_provider_is_set_to_ldap_with_gss_spnego(
+    client: Client, provider: GenericADProvider, method: str
+):
+    """
+    :title: Login to AD when id_provider is set to ldap
+    :setup:
+        1. Add AD user
+        2. Update sssd.conf with 'id_provider = ldap', 'ldap_schema = ad',
+        'ldap_id_use_start_tls = false', 'auth_provider = ad' and
+        'ldap_sasl_mech = gssspengo' and Start SSSD
+    :steps:
+        1. Check authentication of the user
+        2. Check log message in krb5_child.log, UPN [user1@null] should not be logged
+    :expectedresults:
+        1. Authentication is successful
+        2. Get required UPN [user1@<domain_name>] from krb5_child.log
+    :customerscenario: False
+    """
+    provider.user("user1").add()
+
+    client.sssd.config.remove_option("domain/test", "id_provider")
+
+    configurations = {
+        "id_provider": "ldap",
+        "ldap_schema": "ad",
+        "ldap_id_use_start_tls": "False",
+        "auth_provider": "ad",
+        "ldap_referrals": "False",
+        "ldap_sasl_mech": "GSS-SPNEGO",
+        "ldap_id_mapping": "True",
+    }
+
+    for key, value in configurations.items():
+        client.sssd.domain[key] = value
+
+    # id_provider = ldap will not add them automatically if they are not
+    # defined on the server side.
+    client.sssd.nss["default_shell"] = "/bin/bash"
+    client.sssd.nss["override_homedir"] = "/home/%u"
+
+    # `provider.host.domain` is ignored because it is dynamically added
+    p_domain = f"{provider.host.domain}"  # type: ignore[attr-defined]
+
+    client.sssd.domain["krb5_realm"] = f"{p_domain.upper()}"
+    client.sssd.domain["dns_discovery_domain"] = f"{p_domain}"
+
+    client.sssd.start()
+
+    assert client.auth.parametrize(method).password("user1", "Secret123"), "User user1 failed login!"
+
+    log_str = client.fs.read("/var/log/sssd/krb5_child.log")
+    assert f"UPN [user1@{p_domain}]" in log_str, f"'UPN [user1@{p_domain}]' not in logs!"  # type: ignore